CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Apache Doris, an open-source distributed analytical (MPP) database, performs insufficient validation of the JDBC driver URL supplied when configuring external JDBC connections (CWE-829, inclusion of functionality from an untrusted control sphere). An attacker who already holds privileged, admin-level access to a Doris cluster can submit a crafted JDBC driver URL that causes arbitrary code to execute on the Frontend (FE) node. Successful abuse gives code execution as the Doris service account on the FE host, exposing cluster metadata, stored credentials, and the underlying server. Any organization running Apache Doris with JDBC catalog/resource functionality is potentially affected, but exploitation requires privileged access first (e.g., stolen or misused admin credentials), which limits opportunistic external attacks. The CVE has no CVSS score yet, is not in CISA's KEV catalog, and no public proof-of-concept or in-the-wild exploitation is known.