CVE-2026-31377: Apache Doris Auth Bypass Vulnerability

CVE-2026-31377 Overview

CVE-2026-31377 is an improper authentication vulnerability [CWE-287] in the Apache Doris Frontend (FE) meta service. Unauthenticated remote attackers can access internal metadata service endpoints by supplying crafted node information in client requests. The affected endpoints trusted client-supplied identifiers instead of validating the requesting party. Under permissive network configurations, this allows bypass of intended access controls and exposure of sensitive cluster metadata.

The flaw affects Apache Doris versions 2.0.0 through 2.0.*, 2.1.0 through 2.1.*, 3.0.0 through 3.0.*, 3.1.0 through 3.1.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected.

Critical Impact
Unauthenticated remote attackers with network access to the FE service can enumerate internal metadata interfaces and extract sensitive cluster information without credentials.

Affected Products

Apache Doris 2.0.0 through 2.0.* (all releases)
Apache Doris 2.1.0 through 2.1.* (all releases)
Apache Doris 3.0.0 through 3.0.*, 3.1.0 through 3.1.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4

Discovery Timeline

2026-09-23 - CVE CVE-2026-31377 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-31377

Vulnerability Analysis

Apache Doris is a distributed analytical database. Its Frontend (FE) service manages metadata, query planning, and coordination for backend nodes. The FE exposes internal endpoints for inter-node communication that should only be reachable by trusted cluster members.

The vulnerable endpoints authenticate callers based on node identifiers supplied inside the request itself. An attacker who can reach the FE service over the network can forge these identifiers and impersonate a legitimate cluster node. Successful exploitation exposes internal metadata interfaces, which may leak schema information, cluster topology, node credentials references, and configuration data useful for follow-on attacks.

The issue is a header-trust vulnerability introduced starting in Apache Doris 2.0.0. Earlier 1.2.x releases did not implement the trust model that this flaw abuses.

Root Cause

The FE meta service relied on client-supplied node information as the sole authentication signal. No cryptographic verification, mutual TLS, or shared secret validated that the caller was an authorized cluster peer. This falls under improper authentication [CWE-287], where authentication material is present in the request but is not verified against a trusted source.

Attack Vector

The attack requires network reachability to the FE service and no privileges or user interaction. An attacker sends crafted HTTP requests to the internal metadata endpoints with fabricated node identifiers matching the expected trust format. The FE service accepts the request as originating from a trusted peer and returns internal metadata responses.

The vulnerability is exploitable when the FE service port is exposed beyond the intended cluster boundary, such as when deployed without network segmentation or when internal ports are reachable from user networks. Refer to the Apache Mailing List Discussion and the Openwall OSS-Security Update for advisory details.

Detection Methods for CVE-2026-31377

Indicators of Compromise

Unexpected HTTP requests to FE meta service endpoints from IP addresses outside the cluster backend subnet.
Access log entries showing internal metadata endpoint hits with client-supplied node identifiers that do not match registered cluster nodes.
Bursts of enumeration requests against FE administrative or metadata paths from a single external source.

Detection Strategies

Enable FE access logging and alert on requests to internal metadata endpoints originating outside the trusted backend network range.
Correlate FE endpoint access with the registered node inventory. Flag requests using node identifiers that do not correspond to a known Backend (BE) or Frontend (FE) peer.
Monitor for anonymous or credential-less requests that receive successful responses from endpoints intended for cluster-internal use.

Monitoring Recommendations

Ingest Apache Doris FE logs into a centralized logging or SIEM platform and build detections for external access to internal ports.
Deploy network flow monitoring to identify unauthorized clients establishing connections to FE service ports.
Track version strings reported by Doris instances to identify hosts still running affected releases.

How to Mitigate CVE-2026-31377

Immediate Actions Required

Upgrade Apache Doris to version 4.0.8 or 4.1.4, which contain the fix for CVE-2026-31377.
Restrict network access to FE service ports so that only trusted Backend and Frontend cluster nodes can reach internal endpoints.
Audit FE access logs for prior unauthorized requests to metadata endpoints and rotate any credentials or secrets that may have been exposed.

Patch Information

Apache has released fixed versions 4.0.8 and 4.1.4. Users on 2.0.x, 2.1.x, 3.0.x, and 3.1.x branches must migrate to a supported fixed release, as those branches remain affected across all published versions. Consult the Apache Mailing List Discussion for upgrade guidance.

Workarounds

Place Apache Doris FE nodes behind a firewall or private subnet that only permits inbound connections from cluster peers.
Use network policies, security groups, or host-based firewalls to block external access to FE HTTP and RPC ports.
Front the FE service with a reverse proxy that enforces mutual TLS or IP allow-listing for administrative and internal endpoints.

bash

# Example iptables restriction limiting FE port 8030 to trusted cluster subnet
iptables -A INPUT -p tcp --dport 8030 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8030 -j DROP