Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-31377 An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote…

Description

An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Doris 4.1 4.1.0 → < 4.1.4 4.1.4
Apache Doris 4.0 premières → < 4.0.8 4.0.8
Apache Doris 2.0 2.0.0 → < 4.0.8 4.0.8

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Doris

Les 10 CVE de Apache Doris →
CVE-2026-96443 Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution… Non notée CVE-2026-68570 Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access… Non notée CVE-2026-72524 Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access… Non notée CVE-2026-58319 Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication Non notée
Suivre cette CVE