PT-2026-57975 · Apache · Apache Doris

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-58319

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Doris versions prior to 3.1.0

Description Certain HTTP REST administrative APIs in the Frontend (FE) were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, which may compromise cluster integrity and availability, leading to instability or a denial of service.

Recommendations Upgrade to Apache Doris version 3.1.0 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-58319

Affected Products

Apache Doris

References · 4

• https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58319 · Security Note
• http://openwall.com/lists/oss-security/2026/07/14/3 · Note
• https://twitter.com/oss_security/status/2076873995765309606 · Twitter Post