CVE-2026-58319

CVE-2026-58319: Apache Doris: Improper Authentication in Frontend HTTP API

Vendor Apache Software Foundation

Product Apache Doris

Weakness CWE-306 · Missing auth

Published July 14, 2026

Last update July 14, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

Key dates

02Disclosure timeline

July 14, 2026 CVE published

July 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-58319 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html AskarLabs — CWE-306 write-up Missing Authentication for Critical Function

Related vulnerabilities

04Related CVE

CVE-2018-25335 WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload CVE-2023-54352 WordPress Seotheme Remote Code Execution Unauthenticated CVE-2022-34858 WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability CVE-2025-14294 Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification CVE-2026-8732 WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action