Executive brief
Apache Doris, a high-performance analytical database, contains a security flaw where certain administrative interfaces were left unprotected. An unauthorized person with network access to the database management service could perform administrative tasks without a password. This could allow an attacker to disrupt database operations, delete data, or cause a complete service outage.
Technical details
A missing authentication vulnerability (CWE-306) exists in the Apache Doris Frontend (FE) HTTP REST API. The root cause is the failure to enforce authentication checks on specific administrative endpoints. An unauthenticated attacker with network reachability to the FE HTTP service can invoke these REST APIs to perform privileged operations. This can lead to cluster instability, loss of integrity, or a denial of service (DoS) condition. The issue is resolved in Apache Doris version 3.1.0.
Affected products
- Apache Doris 2.1.0 before 3.1.0
Timeline
- 2026-07-14: advisory: Initial public disclosure by Apache Software Foundation
- 2026-07-14: disclosed