CVE-2026-31377
Received Received - Intake

Improper Authentication in Apache Doris Frontend

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-31377
EUVD
EUVD-2026-85172

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
apache doris From 2.0.0 (inc) to 2.0.* (inc)
apache doris From 2.1.0 (inc) to 2.1.* (inc)
apache doris From 3.0.0 (inc) to 3.0.* (inc)
apache doris From 3.1.0 (inc) to 3.1.* (inc)
apache doris From 4.0.0 (inc) to 4.0.8 (exc)
apache doris From 4.1.0 (inc) to 4.1.4 (exc)
apache doris 4.0.8
apache doris 4.1.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Authentication issue in Apache Doris Frontend (FE) meta service. It allows unauthenticated remote attackers to access internal metadata service endpoints due to insufficient authentication of the requesting party. Attackers can bypass access control and access sensitive cluster information under certain network configurations.

Detection Guidance

Check Apache Doris Frontend (FE) logs for unauthorized access attempts to internal metadata service endpoints. Look for requests to FE ports (default 9010, 9020, 9030) from unexpected sources. Use network scanning tools like nmap to identify exposed FE interfaces. Verify if FE nodes are accessible without proper authentication.

Impact Analysis

An attacker could exploit this to access sensitive cluster metadata, potentially exposing internal system details or configurations. This could lead to further attacks or unauthorized access to data within the Apache Doris environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive cluster information, which may include personal or health data. This could violate GDPR if personal data is exposed or HIPAA if protected health information is compromised.

Mitigation Strategies

Upgrade Apache Doris to a fixed version: 4.0.8 or 4.1.4 or later to address the improper authentication issue in the Frontend meta service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31377. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart