Authentication Bypass in Apache Doris FE HTTP REST APIs

Executive Summary

CVE-2026-58319 is an improper authentication vulnerability in Apache Doris affecting versions prior to 3.1.0. Certain Frontend (FE) HTTP REST administrative APIs in Apache Doris were accessible without proper authentication.

An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations. This could potentially compromise cluster integrity and availability, leading to cluster instability or denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can check if your Apache Doris Frontend (FE) HTTP service is exposing administrative APIs without proper authentication. Since the vulnerability affects versions prior to 3.1.0, first verify the installed version of Apache Doris.

• Check the Apache Doris version: Run the following command to determine the version if you have access to the FE node: curl -X GET http://<FE_IP>:<FE_HTTP_PORT>/api/bootstrap
• Test for unauthenticated access to administrative APIs: Use tools like curl to send requests to known administrative endpoints. For example: curl -X GET http://<FE_IP>:<FE_HTTP_PORT>/api/_health
• If the above requests return successful responses (e.g., HTTP 200) without requiring authentication, the system is likely vulnerable.
• Scan for open FE HTTP ports: Use network scanning tools like nmap to identify open ports associated with Apache Doris FE services. Example: nmap -p <FE_HTTP_PORT> <FE_IP>

If any of these checks confirm unauthenticated access or an outdated version, immediate action is required to mitigate the risk.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of Apache Doris (prior to 3.1.0), this vulnerability could impact you in the following ways:

• An attacker could gain unauthorized access to administrative APIs, allowing them to perform actions that could disrupt your cluster.
• The cluster's integrity and availability could be compromised, leading to instability or a denial of service.
• Sensitive operations or data managed by the cluster could be exposed or manipulated without authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with common standards and regulations in the following ways:

• GDPR: Unauthorized access to administrative APIs could lead to exposure or manipulation of personal data, violating GDPR requirements for data protection and confidentiality.
• HIPAA: If the cluster manages protected health information (PHI), unauthorized access could result in breaches of confidentiality, integrity, or availability, violating HIPAA security rules.
• Other standards (e.g., ISO 27001, SOC 2): The vulnerability undermines security controls related to access management and system integrity, potentially leading to non-compliance with requirements for protecting sensitive data and ensuring system availability.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation for this vulnerability is to upgrade Apache Doris to version 3.1.0 or later, as this version includes fixes for the improper authentication issue.

• Upgrade Apache Doris: Follow the official Apache Doris upgrade guide to upgrade to version 3.1.0 or later. Ensure you back up all critical data before performing the upgrade.
• Restrict network access: If upgrading is not immediately possible, restrict network access to the FE HTTP service. Use firewalls or network security groups to limit access to trusted IP addresses only.
• Disable unnecessary administrative APIs: If certain administrative APIs are not required, disable them temporarily until the upgrade is completed.
• Monitor for suspicious activity: Enable logging and monitoring for the FE HTTP service to detect any unauthorized access attempts or unusual administrative operations.

After applying these mitigations, verify that the vulnerability has been resolved by testing for unauthenticated access again.

Useful 0 Not Useful 0