ZeroHour

CVE-2026-68570

moderate

Authorization Bypass in Apache Doris Leaks Protected Data to Authenticated Users

CVSS 3.1
6.5 medium
EPSS
Published
()
Modified
AI analysis

CVE-2026-68570 is an incorrect authorization flaw (CWE-863) in Apache Doris, the open-source MPP analytical database, that allows an authenticated user to bypass privilege checks and read data they are not authorized to access. It is triggered through ordinary query activity by a logged-in user holding limited privileges, and the impact is unauthorized information disclosure rather than code execution or data modification. All deployments running Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, or 4.1.0 before 4.1.4 are affected, with fixes available in 4.0.8 and 4.1.4. Because exploitation requires valid credentials, the realistic threat is a malicious insider or a compromised low-privilege account silently reading sensitive tables. No CVSS score has been assigned yet, no public proof-of-concept exists, and the issue is not in CISA's KEV, so no exploitation is currently known.

What to do: Upgrade to Apache Doris 4.0.8 or 4.1.4 as soon as possible; organizations on the 2.0.x–2.1.x or 3.0.x lines have no patched release in those branches and should plan an upgrade to a fixed 4.x build. Until patched, audit user accounts and granted privileges, and review query/audit logs for any user accessing tables outside their assigned permissions. Restrict network access to Doris FE/BE ports so only legitimate clients can reach the cluster, and rotate credentials for low-privilege analytical accounts if misuse is suspected.

Affected
Apache Doris2.0.0 through 2.1.*
Apache Doris3.0.0 through 3.0.*
Apache Doris4.0.0 before 4.0.8
Apache Doris4.1.0 before 4.1.4
Estimated exposure
moderate≈ low thousands of Doris deployments worldwide, with likely hundreds to low-thousands of internet-exposed nodes — Apache Doris is an enterprise open-source OLAP data warehouse with a global but limited install base (strongest adoption in China), and public scan engines typically show only a modest number of internet-exposed Doris frontends, so…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Weakness
CWE-863
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In the news

CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access

Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.

CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.

oss-security · 1d agoVulnerabilityCVE-2026-68570