CVE-2026-58319
Critical · CVSS 9.1Apache Doris — Missing Authentication for Critical Function (CWE-306) - Unauthenticated REST API Access
- CVSS
- 9.1
- nvd
- EPSS
- 0.26%
- 17th pct
- KEV
- No
- Class
- other
- CWE-306
Description
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.
Search profile — drives PoC discovery
Symbols FE HTTP REST APIFE HTTP serviceadministrative APIfrontend HTTPApache Doris FEREST administrative endpoints
Keywords CVE-2026-58319Apache Dorisunauthenticated REST APIFE HTTP authentication bypassDoris frontend REST adminCWE-306 DorisDoris missing authenticationDoris admin API no authApache Doris DoS unauthenticatedDoris 3.1.0 authentication fix
Versions: < 3.1.0
References
Status: enriched · ingested 2026-07-14T18:00:20.000Z · profiled 2026-07-15T00:30:20.000Z