CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.
The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information.
This issue affects Apache Doris: from 2.0.0 through 2.0., from 2.1.0 through 2.1., from 3.0.0 through 3.0., from 3.1.0 through 3.1., from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Doristo a version that resolves this vulnerability.Fixed in 4.0.8 - Upgrade
Upgrade
Apache Doristo a version that resolves this vulnerability.Fixed in 4.1.4
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Apache Doris FE deployments are exposed when their internal metadata service endpoints can be reached remotely under network configurations that permit an attacker to bypass the intended access control. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.
What does an attacker need to exploit the vulnerability?
An attacker does not need authentication, privileges, or user interaction. They need remote network reachability to the affected FE metadata service in a network configuration where the service's trust of client-supplied node information can be abused.
What information could be exposed?
Successful exploitation can provide access to internal FE metadata service endpoints and may expose sensitive cluster information. The provided information does not indicate an integrity or availability impact.
What should teams do if they are running an affected release?
Upgrade to Apache Doris 4.0.8 or 4.1.4, which fix the issue. If an immediate upgrade is not possible, restrict remote access to internal FE metadata service endpoints so untrusted remote clients cannot reach them.
How can I determine whether my version is affected?
Affected releases include 2.0.x, 2.1.x, 3.0.x, 3.1.x, 4.0.x before 4.0.8, and 4.1.x before 4.1.4. Releases in the 1.2.x line and earlier are not affected.