CVE-2026-58319Patch(apache / doris)

LOWCVSS 9.1 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch apache doris systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

doris

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked at 3 mentions on most recent observed day (2026-07-20)
4 total mentions across 2 days

Affected systems

Vendors

apache

Products

doris

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Patch

375.0%

Disclosure

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-14	1	Disclosure1
2026-07-20	3	Patch3

Full discourse4 posts

yousukezan@yousukezan84d
Patch
Apache DorisのFrontend（FE）HTTP REST管理APIに認証なしでアクセスできる重大な脆弱性CVE-2026-58319が修正された。攻撃者は認証なしで管理操作を実行でき、クラスタの可用性や安定性に影響を与える可能性があるため、利用者には更新が推奨されている。影響を受けるのはApache Doris 2.1.0以上3.1.0未満のバージョンである。原因はFE HTTPサービスにおける認証チェックの不備で、一部の管理用REST APIがリクエスト元の認証を検証していなかった。そのため、FE HTTPポートへ到達可能な攻撃者は認証を経ることなく管理用リクエストを送信できる。Apacheは、この問題によりクラスタの整合性や可用性が損なわれ、クラスタの不安定化やサービス妨害（DoS）につながる可能性があるとしている。現時点で実際の悪用や公開されたPoCの存在は確認されていない。修正版はApache Doris 3.1.0以降で、この問題が修正されている。更新までの暫定対策として、ApacheはFrontend HTTPサービスへのネットワークアクセスを制限し、信頼できるネットワークからのみアクセスできるよう保護することを推奨している。 https://securityonline.info/apache-doris-cve-2026-58319/
Post summary
CVE-2026-58319 is a critical unauthenticated access flaw in Apache Doris’s FE REST API, now fixed in version 3.1.0+. No exploitation or PoC has been reported, and users are urged to apply the patch or restrict network access to the FE service.
110732.3K
14.9K followersView on X
Daily CyberSecurity@Daily_CyberSec85d
Patch
Apache Doris vulnerability CVE-2026-58319 lets unauthenticated attackers hit FE HTTP admin APIs. Upgrade to Doris 3.1.0 now to close the flaw. #ApacheDoris #CVE202658319 #ImproperAuthentication #DatabaseSecurity #CyberSecurity http://securityonline.info/apache-doris-cve-2026-58319/
Post summary
The post announces CVE-2026-58319, an Improper Authentication vulnerability in Apache Doris that lets unauthenticated users access admin APIs, and advises upgrading to Doris 3.1.0 to remediate.
02080463
12.9K followersView on X
ThreatWire@ThreatWire_85d
Patch
🚨 CVE-2026-58319: A vulnerability in Apache Doris allows unauthenticated attackers to access FE HTTP admin APIs. Users should upgrade to Apache Doris 3.1.0 to mitigate the issue. #ApacheDoris #CyberSecurity #CVE
Post summary
The advisory highlights a CVE that permits unauthenticated access to Apache Doris admin APIs and recommends upgrading to version 3.1.0 for remediation.
0001067
347 followersView on X
Open Source Security mailing list@oss_security91d
Disclosure
CVE-2026-58319: Apache Doris: Improper Authentication in Frontend HTTP API https://www.openwall.com/lists/oss-security/2026/07/14/3 Severity: critical Doris is a real-time database for modern analytics and AI
Post summary
The post discloses a critical improper authentication flaw in Apache Doris’s frontend HTTP API.
00010448
4.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	doris	-	-	-

Explore more

Back to dashboard apache CVEs doris vulnerabilities

What researchers are saying

CVE-2026-58319

yousukezan[verified]@yousukezanPatch

CVE-2026-58319 is a critical unauthenticated access flaw in Apache Doris’s FE REST API, now fixed in version 3.1.0+. No exploitation or PoC has been reported, and users are urged to apply the patch or restrict network access to the FE service.

Daily CyberSecurity@Daily_CyberSecPatch

The post announces CVE-2026-58319, an Improper Authentication vulnerability in Apache Doris that lets unauthenticated users access admin APIs, and advises upgrading to Doris 3.1.0 to remediate.

ThreatWire@ThreatWire_Patch

The advisory highlights a CVE that permits unauthenticated access to Apache Doris admin APIs and recommends upgrading to version 3.1.0 for remediation.

Open Source Security mailing list@oss_securityDisclosure

The post discloses a critical improper authentication flaw in Apache Doris’s frontend HTTP API.