Apache Doris (Product): news timeline & CVEs

CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Apache Doris JDBC driver URL validation bypass CVE-2026-96443 can lead to remote code execution; Apache rates it moderate.

Apache disclosed CVE-2026-96443, a moderate-severity vulnerability in Apache Doris, in an oss-security post by Calvin Kirs on September 23, 2026. A JDBC driver URL validation bypass can lead to remote code execution. The short notice does not list affected versions or say the flaw is being exploited.

oss-securitySep 23, 15:33 UTC · 3d agoVulnerability 2 sources CVE-2026-964431

CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

CVE-2026-31377 lets unauthenticated attackers reach the Apache Doris Frontend meta service; CVSS score is 7.5.

Apache disclosed CVE-2026-31377, an improper-authentication flaw in the Apache Doris Frontend meta service, rated important. CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), so an unauthenticated remote attacker can access the service with high confidentiality impact. Affected ranges are 2.0.0 before 4.0.8 and 4.1.0 before 4.1.4. Builds before 2.0.0, from 4.0.8 before 4.1.0, and 4.1.4 or later are unaffected. No in-the-wild exploitation is mentioned.

oss-securitySep 23, 15:31 UTC · 3d agoVulnerability 2 sources CVE-2026-31377

Apache Doris

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution

CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service