Apache Doris Vulnerabilities Patched in New Updates

TL;DR

The Apache Software Foundation addressed two security flaws in its real-time analytics database. These Apache Doris vulnerabilities allow remote attackers to access cluster metadata or execute arbitrary code. Administrators should install the latest security updates immediately to protect their servers.

Why It Matters

Telemetry estimates indicate that thousands of data analytics clusters use Apache Doris globally. Therefore, security defects in this platform can expose distributed systems to unauthorized access. The more severe flaw carries a CVSS score of 7.5 and affects the Frontend metadata service. Another defect allows a privileged attacker to achieve remote code execution on the Frontend. Fortunately, researchers responsibly disclosed both flaws to the project team. Security teams have confirmed no active exploitation in the wild. Additionally, researchers have not published any public proof-of-concept exploit code. Even so, these Apache Doris vulnerabilities require prompt attention to maintain cluster safety.

How The Attack Works

The flaws stem from broken authentication checks and weak URL validation. The advisory for CVE-2026-31377 describes how the metadata service trusts incoming requests. Specifically, the project team explained, “The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party.” Consequently, an unauthenticated attacker bypasses access controls to retrieve internal cluster configuration details. Meanwhile, CVE-2026-96443 involves insufficient validation of the JDBC driver URL. A user with existing privileges can supply a crafted database connection string. This action triggers remote code execution directly on the Frontend node.

Affected Versions

The metadata access flaw impacts Apache Doris versions from 2.0.0 through 4.0.7. It also affects versions 4.1.0 through 4.1.3. Versions 1.2.x and earlier remain unaffected by this issue. In contrast, the JDBC driver vulnerability affects versions 2.0.5 through 4.1.3.

Patch Or Mitigation Steps

Administrators should update their clusters to patched software versions immediately. The development team resolved the flaws in Apache Doris 4.0.8 and 4.1.4. You can obtain the latest fixed binaries directly from the official Apache Doris download page. Furthermore, security teams should restrict network access to internal Frontend service ports. Securing your deployment against these Apache Doris vulnerabilities prevents unauthorized exposure of business intelligence data.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.