CVE-2026-31377— Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
Quick assessment
Affected
Apache Software Foundation Apache Doris
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authenticatio
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-31377
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
Source: CVE Program / CVE List V5
Vulnerability Description
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.
The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information.
This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Doris | 2.0.0 ~ 4.0.8 | - |
|
II. Public POCs for CVE-2026-31377
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-31377
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-09-23 · 25 CVEs total
| CVE-2026-76183 | Apache Tomcat: Bypass of security constraints for WebSocket endpoints | |
| CVE-2026-82331 | Apache BuildStream: tar source extraction escape | |
| CVE-2026-73192 | Apache Sling XSS: XSS possible through XSSAPI.getValidHref() | |
| CVE-2026-92001 | Apache Sling XSS: Missing parser resource limits | |
| CVE-2026-91999 | Apache Sling XSS: Improper escaping in the XSS Webconsole plugin | |
| CVE-2026-91852 | Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl | |
| CVE-2026-96443 | Apache Doris: JDBC driver URL validation bypass leads to remote code execution | |
| CVE-2026-91928 | Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf prote | |
| CVE-2026-94251 | Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape | |
| CVE-2026-94243 | Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence | |
| CVE-2026-73581 | Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate us | |
| CVE-2026-75973 | Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured | |
| CVE-2026-86247 | Apache Tomcat Native: Client certificate requirements can be down-graded | |
| CVE-2026-77756 | Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | |
| CVE-2026-77762 | Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request | |
| CVE-2026-77791 | Apache Tomcat: DoS via busy wait during WebSocket close | |
| CVE-2026-78383 | Apache Tomcat: AJP DoS via missing request body | |
| CVE-2026-78437 | Apache Tomcat: HTTP/2 DoS via malformed request | |
| CVE-2026-79677 | Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout | |
| CVE-2026-86248 | Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Doris
-
CVE-2026-96443
Apache Doris: JDBC driver URL validation bypass leads to rem -
CVE-2026-68570
Apache Doris: Authorization bypass leading to unauthorized d -
CVE-2026-72524
Apache Doris: Authorization bypass allowing a low-privilege -
CVE-2026-58319
Apache Doris: Improper Authentication in Frontend HTTP API -
CVE-2024-48019
Apache Doris: allows admin users to read arbitrary files thr
Same vendor: Apache Software Foundation
-
CVE-2026-86247
Apache Tomcat Native: Client certificate requirements can be -
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled -
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake -
CVE-2026-87022
Apache Tomcat: WebSocket message smuggling with per-message- -
CVE-2026-86350
Apache Tomcat: Regression in fix for CVE-2026-41293 can trig
Same weakness: CWE-287
-
CVE-2026-95676
AuthPoint Gateway Improper Authentication in LDAP Sync Allow -
CVE-2026-75973
Apache Tomcat: Cross-context authentication mix-up with Jaka -
CVE-2026-96445
Keycloak-services: keycloak-services: conditional otp skip-h -
CVE-2026-18074
IBM Financial Transaction Manager (FTM) is Impacted by Multi -
CVE-2026-77244
[mcp-atlassian] Authentication bypass in HTTP transport: Atl
V. Comments for CVE-2026-31377
No comments yet