CVE-2026-58319 is a critical flaw (CVSS 9.1) in Apache Doris. Certain frontend (FE) HTTP REST administrative APIs were reachable without authentication. Versions before 3.1.0 are affected. Upgrade to 3.1.0 or later, and keep the FE HTTP port off untrusted networks.
What's affected
- Apache Doris 2.1.0 before 3.1.0, per the announcement. The record says versions prior to 3.1.0.
- Fixed version: 3.1.0 or later.
How to check if you're exposed
Run SHOW FRONTENDS; from a SQL client. It lists the version of each frontend. Then check which networks can reach the FE HTTP port, because the attack needs network access to that service.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade Doris to 3.1.0 or later.
- Restrict the FE HTTP port with firewall rules or security groups.
- Put the cluster behind a private network or VPN.
- Review FE logs for unexpected administrative calls.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
This is CWE-306 (Missing Authentication for Critical Function). Administrative functions did not require a login. Apache says the result could be unauthorized administrative operations that affect cluster integrity and availability, up to instability or denial of service.
The announcement rates it critical. The CISA KEV flag is false.
Doris is a data warehouse, and the frontend nodes coordinate metadata and query planning. An unauthenticated administrative API on the frontend HTTP port therefore reaches the part of the cluster that decides what everything else does. The announcement describes the effect as cluster instability or denial of service, and unauthorized administrative operations more broadly.
A practical rule applies: the frontend HTTP port should never be reachable from a user network or the internet. Even after upgrading, keep it on an internal segment and put a reverse proxy or gateway in front of anything that must be exposed.
Quick check
Is a network restriction enough?
It reduces exposure, but the advisory recommends upgrading.
Sources
Last reviewed: 19 October 2026.
