Apache Doris (Apache Software Foundation) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-23. Vendor: Apache Software Foundation.
CVEs of Apache Doris
- CVE-2026-96443 - CVSS 6.5 (medium), 2026-09-23: Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.
- CVE-2026-31377 - CVSS 7.5 (high), 2026-09-23: An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata…
- CVE-2026-68570 - CVSS 6.5 (medium), 2026-09-14: Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read,…
- CVE-2026-72524 - CVSS 8.8 (high), 2026-09-14: Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not…
- CVE-2026-58319 - CVSS 9.1 (critical), 2026-07-14: Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE…
- CVE-2024-48019 - CVSS 5.4 (medium), 2025-02-04: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache…
- CVE-2024-27438 - CVSS 9.8 (critical), 2024-03-21: Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote…
- CVE-2024-26307 - CVSS 5.3 (medium), 2024-03-21: Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from…
- CVE-2023-41313 - CVSS 9.8 (critical), 2024-03-12: The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or…
- CVE-2023-41314 - CVSS 8.2 (high), 2023-12-18: The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node.…
