AI analysis
CVE-2026-68570 is an incorrect authorization flaw (CWE-863) in Apache Doris, the open-source MPP analytical database, that allows an authenticated user to bypass privilege checks and read data they are not authorized to access. It is triggered through ordinary query activity by a logged-in user holding limited privileges, and the impact is unauthorized information disclosure rather than code execution or data modification. All deployments running Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, or 4.1.0 before 4.1.4 are affected, with fixes available in 4.0.8 and 4.1.4. Because exploitation requires valid credentials, the realistic threat is a malicious insider or a compromised low-privilege account silently reading sensitive tables. No CVSS score has been assigned yet, no public proof-of-concept exists, and the issue is not in CISA's KEV, so no exploitation is currently known.
What to do: Upgrade to Apache Doris 4.0.8 or 4.1.4 as soon as possible; organizations on the 2.0.x–2.1.x or 3.0.x lines have no patched release in those branches and should plan an upgrade to a fixed 4.x build. Until patched, audit user accounts and granted privileges, and review query/audit logs for any user accessing tables outside their assigned permissions. Restrict network access to Doris FE/BE ports so only legitimate clients can reach the cluster, and rotate credentials for low-privilege analytical accounts if misuse is suspected.
Affected
| Apache Doris | 2.0.0 through 2.1.* |
| Apache Doris | 3.0.0 through 3.0.* |
| Apache Doris | 4.0.0 before 4.0.8 |
| Apache Doris | 4.1.0 before 4.1.4 |
Estimated exposure
moderate≈ low thousands of Doris deployments worldwide, with likely hundreds to low-thousands of internet-exposed nodes — Apache Doris is an enterprise open-source OLAP data warehouse with a global but limited install base (strongest adoption in China), and public scan engines typically show only a modest number of internet-exposed Doris frontends, so…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.