Apache Doris CVE-2026-96443

Exploitation requires an already-authenticated, privileged Apache Doris user who can define or modify a JDBC catalog/external resource driver URL - the description explicitly limits this to a 'privileged user,' so it is not exploitable by anonymous or low-privilege actors. The concrete prerequisite is the ability to set an attacker-controlled JDBC driver URL that the Frontend then loads without sufficient validation. Limiting factors: high privilege level required, the FE must process the attacker-supplied URL, and there is no user-interaction or default-config path for an external unauthenticated attacker. Affected versions are unspecified in the provided data, so version-based scoping cannot be confirmed.

No CVSS, EPSS, KEV, or POC data was provided, so quantitative exploitation signals are entirely absent and cannot be used to prioritize. Qualitatively, this is a CWE-829 (inclusion of functionality from an untrusted control sphere) issue: insufficient validation of the JDBC driver URL lets an attacker load and execute code on the Doris Frontend (FE), the classic JDBC-URL-injection-to-RCE pattern where an attacker-controlled connection string coerces the JVM into fetching/deserializing malicious driver logic. The single most important limiter, stated explicitly in the description, is that a 'privileged user' is required - this is NOT unauthenticated RCE. That downgrades real-world urgency substantially: the attacker must already hold an authenticated, high-privilege Doris account capable of defining a JDBC catalog/resource URL. The impact ceiling is high (full RCE on the FE = confidentiality, integrity, and availability compromise of the control plane), but the privilege gate makes this closer to a privilege-escalation/post-compromise vector than a mass-exploitable perimeter flaw. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation; treat this as a patch-in-normal-cycle item unless the FE is exposed to semi-trusted users. Key data is missing and must be verified with the vendor: no official CVSS vector, and affected/fixed versions are unknown (CPE is a wildcard apache_doris:*).

An attacker who already holds a privileged Apache Doris account (or has compromised such credentials) creates or edits a JDBC catalog/external resource and supplies a crafted JDBC driver URL that is insufficiently validated. When the Frontend processes that URL, it loads attacker-controlled driver code and executes it in the JVM, yielding remote code execution on the FE. No public exploit is identified at time of analysis, though the JDBC-URL-injection technique is well documented in the Java ecosystem.