CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
CVE-2026-31377 lets unauthenticated attackers reach the Apache Doris Frontend meta service; CVSS score is 7.5.
Apache disclosed CVE-2026-31377, an improper-authentication flaw in the Apache Doris Frontend meta service, rated important. CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), so an unauthenticated remote attacker can access the service with high confidentiality impact. Affected ranges are 2.0.0 before 4.0.8 and 4.1.0 before 4.1.4. Builds before 2.0.0, from 4.0.8 before 4.1.0, and 4.1.4 or later are unaffected. No in-the-wild exploitation is mentioned.
- CVE-2026-31377 is rated important with CVSS 3.1 base 7.5.
- Unauthenticated remote attackers can access the Frontend meta service.
- Vector is network, no privileges, high confidentiality only.
- Fixes are in 4.0.8 and 4.1.4; some ranges are unaffected.
- CVEs
- CVE-2026-31377
- Vendors
- Apache
- Products
- Apache Doris
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-31377 | Improper Authentication in Apache Doris Frontend Meta Service | 7.5 | — |
From the original article
Posted by Calvin Kirs on Sep 23 Severity: important CVSS 3. 1: 7. 5 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.