CVE-2026-96443

Apache Doris, an open-source distributed analytical (MPP) database, performs insufficient validation of the JDBC driver URL supplied when configuring external JDBC connections (CWE-829, inclusion of functionality from an untrusted control sphere). An attacker who already holds privileged, admin-level access to a Doris cluster can submit a crafted JDBC driver URL that causes arbitrary code to execute on the Frontend (FE) node. Successful abuse gives code execution as the Doris service account on the FE host, exposing cluster metadata, stored credentials, and the underlying server. Any organization running Apache Doris with JDBC catalog/resource functionality is potentially affected, but exploitation requires privileged access first (e.g., stolen or misused admin credentials), which limits opportunistic external attacks. The CVE has no CVSS score yet, is not in CISA's KEV catalog, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Check the official Apache Doris security advisory for the fixed release and upgrade the FE nodes as soon as it is available — no affected or fixed version range was given in the initial notice, so verify against the advisory directly. In the meantime, restrict which accounts can execute JDBC catalog/resource creation statements, rotate admin credentials, and review audit logs for unexpected catalog creation activity. Ensure FE ports (8030, 9010, 9030) are not exposed to the public internet and run the FE process under a least-privileged service account.