Apache Doris Fixes Flaws Exposing Cluster Data and Enabling RCE

The Apache Software Foundation has patched two vulnerabilities in Apache Doris, its real-time analytics database. CVE-2026-31377, rated 7.5 (High) on CVSSv3, affects the Frontend metadata service and can allow an unauthenticated attacker to bypass access controls and retrieve internal cluster configuration details. The issue results from endpoints relying on client-supplied node information without adequately authenticating the requester. It affects Doris versions 2.0.0 to 4.0.7 and 4.1.0 to 4.1.3; versions 1.2.x and earlier are not affected.

CVE-2026-96443 has a CVSSv3 score of 6.5 and involves insufficient validation of JDBC driver URLs. A user with existing privileges can provide a crafted database connection string to execute code remotely on a Frontend node. It affects versions 2.0.5 through 4.1.3. The project fixed CVE-2026-31377 in versions 4.0.8 and 4.1.4, while the article does not identify a fixed version for CVE-2026-96443 in its summary table, although it directs administrators to those releases.

The flaws were responsibly disclosed, with no confirmed exploitation or public proof-of-concept code reported. Administrators should update through the official Apache Doris download page and restrict network access to internal Frontend service ports.