Apache Doris CVE-2026-31377

Requires network reachability to the Apache Doris FE meta service internal metadata endpoints, and the flaw is explicitly gated by deployment: it is exploitable only 'under certain network configurations' where those FE interfaces are reachable by the attacker. The root cause is that the affected endpoints authenticate callers using client-supplied node information (header trust) rather than authenticating the requesting party, so an unauthenticated remote attacker (PR:N/UI:N) who reaches the endpoint can spoof trusted-node data. Limiting factors: only Apache Doris 2.0.0-2.1.*, 3.0.0-3.1.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4 are affected (1.2.x and earlier are not), and network segmentation that keeps FE meta interfaces off attacker-reachable networks prevents exploitation. Impact is confidentiality-only (metadata/cluster information disclosure).

This is a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) reports a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact - consistent with metadata/information disclosure rather than takeover. The CWE-287 improper-authentication classification is accurate: authentication is based on client-supplied node information (a header-trust design), so an attacker who can reach the FE meta endpoints can impersonate a trusted node. The key tempering signal is in the description itself: exploitation only works 'under certain network configurations,' which argues the real-world attack complexity is higher than the AC:L in the vector suggests - deployments that keep FE meta interfaces on a private/segmented network are not exposed. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automatable exploitation; the only source is the Apache mailing-list advisory. Net: a real, patch-worthy confidentiality issue for internet- or broadly-network-exposed Doris FE nodes, but not a drop-everything item absent exposure of the meta service. Note the C:H/I:N/A:N shape means this leaks cluster information, it does not directly grant code execution or data modification.

An attacker who can reach an Apache Doris FE node's meta service endpoints (e.g., on a flat network or an exposed management interface) sends crafted requests supplying node information that the server trusts for authentication, without proving it is a legitimate cluster node. Because the endpoints authenticate the caller solely on that client-supplied data, the attacker bypasses access control and reads internal FE metadata interfaces, harvesting sensitive cluster information. No public exploit code was identified at time of analysis; exploitation depends on the FE meta service being network-reachable to the attacker.