What is the CVSS score of CVE-2026-58319?

CVE-2026-58319 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache Doris are affected by CVE-2026-58319?

Apache Doris Frontend versions prior to 3.1.0 contain a critical authentication bypass that allows any network user to perform administrative operations on active database clusters, potentially…. A patch is available.

How to fix or mitigate CVE-2026-58319?

Within 24 hours, inventory all systems running Apache Doris versions 2.1.0 through pre-3.1.0 to identify affected infrastructure and assess network exposure of the HTTP REST administrative APIs. Within 7 days, upgrade all affected Doris instances to version 3.1.0 or later, or implement network-level access controls (firewall rules, VPN isolation) to restrict HTTP access to the FE service to trusted administrative networks only. Within 30 days, conduct post-patch verification testing to confirm API authentication is enforced and validate cluster stability.

Apache Doris CVE-2026-58319

EUVD-2026-43653 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-14

GHSA-qpcc-x57v-683v

Authentication Bypass Denial Of Service Apache Doris

9.1

CVSS 3.1 · NVD

Severity by source

Vendor (CNA) PRIMARY

CRITICAL

qualitative

NVD

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network REST access to admin functions gives AV:N/AC:L/PR:N/UI:N; impact is integrity and availability (I:H/A:H) with no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 16:22 NVD

9.1 (CRITICAL)

Patch available

Jul 14, 2026 - 11:17 EUVD

Analysis Generated

Jul 14, 2026 - 02:16 vuln.today

CVE Published

Jul 14, 2026 - 02:08 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Authentication Bypass in Apache Doris Frontend REST API - CVE-2026-58319 Jul 14, 2026

AnalysisAI

Missing authentication on Apache Doris Frontend (FE) HTTP REST administrative APIs allows any unauthenticated attacker with network reach to the FE HTTP service to invoke privileged administrative operations, degrading cluster integrity and availability up to full denial of service. All Apache Doris releases before 3.1.0 (per EUVD, the 2.1.0 through pre-3.1.0 line) are affected, and a fixed release exists in 3.1.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the 9.1 Critical CVSS reflects the trivial unauthenticated network exploitability rather than confirmed in-the-wild use.

Technical ContextAI

Apache Doris is an open-source real-time MPP analytical (OLAP) database; its Frontend (FE) nodes handle metadata, query planning, and cluster coordination, and expose a set of HTTP REST endpoints for administration alongside the query/MySQL protocol. The flaw is a CWE-306 (Missing Authentication for Critical Function) issue: specific FE administrative REST endpoints did not enforce authentication, so requests that should require operator credentials were served to any caller able to reach the FE HTTP port. Because FE governs cluster state, unauthenticated calls to these administrative functions translate directly into control over cluster behavior rather than mere information disclosure.

RemediationAI

Vendor-released patch: upgrade to Apache Doris 3.1.0 or later, which is the fixed release identified by the vendor and confirmed as patch-available in the intelligence data. Until the upgrade is applied, restrict network access to the FE HTTP service so that only trusted administrative hosts/management networks can reach it - enforce this with firewall rules, security groups, or a reverse proxy that requires authentication in front of the FE HTTP port; the trade-off is that any legitimate tooling or monitoring hitting those REST endpoints must be allowlisted or it will break. Avoid binding the FE HTTP interface to public or broad internal networks, and place Doris FE nodes behind a segmented management VLAN. Refer to the Apache advisory materials at https://doris.apache.org, https://seclists.org/oss-sec/2026/q3/133, and https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4 for authoritative upgrade guidance.