CVE-2026-58319: CWE-306 Missing Authentication for Critical Function in Apache Software Foundation Apache Doris
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.
AI Analysis
Technical Summary
CVE-2026-58319 describes a missing authentication vulnerability (CWE-306) in Apache Doris FE HTTP REST administrative APIs. The affected versions prior to 3.1.0 allow unauthenticated attackers with network access to perform administrative operations without proper authentication. This can compromise cluster integrity and availability, leading to instability or denial of service conditions. The vulnerability is resolved in Apache Doris 3.1.0 and later versions.
Potential Impact
An unauthenticated attacker can access critical administrative APIs on the Apache Doris FE HTTP service, enabling unauthorized administrative actions. This can disrupt cluster operations, degrade availability, and cause instability or denial of service. The vulnerability affects cluster integrity and availability but does not specify data confidentiality or integrity compromise beyond administrative control.
Mitigation Recommendations
Users should upgrade to Apache Doris version 3.1.0 or later, where this authentication issue has been addressed. No official patch or temporary fix details are provided, but upgrading is the recommended remediation. Since this is not a cloud service, remediation depends on user action to upgrade affected installations.
CVE-2026-58319: CWE-306 Missing Authentication for Critical Function in Apache Software Foundation Apache Doris
Description
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.
CVSS v3.1
Score 9.1critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58319 describes a missing authentication vulnerability (CWE-306) in Apache Doris FE HTTP REST administrative APIs. The affected versions prior to 3.1.0 allow unauthenticated attackers with network access to perform administrative operations without proper authentication. This can compromise cluster integrity and availability, leading to instability or denial of service conditions. The vulnerability is resolved in Apache Doris 3.1.0 and later versions.
Potential Impact
An unauthenticated attacker can access critical administrative APIs on the Apache Doris FE HTTP service, enabling unauthorized administrative actions. This can disrupt cluster operations, degrade availability, and cause instability or denial of service. The vulnerability affects cluster integrity and availability but does not specify data confidentiality or integrity compromise beyond administrative control.
Mitigation Recommendations
Users should upgrade to Apache Doris version 3.1.0 or later, where this authentication issue has been addressed. No official patch or temporary fix details are provided, but upgrading is the recommended remediation. Since this is not a cloud service, remediation depends on user action to upgrade affected installations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-06-30T03:29:32.156Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a56095968715ace4346dd97
Added to database: 07/14/2026, 10:03:05 UTC
Last enriched: 07/14/2026, 10:17:43 UTC
Last updated: 08/27/2026, 00:51:24 UTC
Views: 142
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.