CVE-2026-58319 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-58319 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-58319 is an authentication bypass vulnerability affecting the Apache Doris Frontend (FE) HTTP REST administrative API, allowing unauthenticated network access to privileged administrative endpoints.

Technical Detail

The flaw exists because certain administrative REST API endpoints exposed by the Apache Doris Frontend HTTP service do not enforce authentication checks, leaving them accessible to any client with network connectivity to the FE HTTP port. An unauthenticated attacker can directly invoke these endpoints without supplying credentials, bypassing the intended access controls entirely. Depending on the specific APIs exposed, exploitation could enable unauthorized administrative actions such as configuration modification, data access, or cluster manipulation, with a CVSS score of 9.1 reflecting the high impact and low attack complexity.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning active in-the-wild exploitation has not been confirmed or publicly documented as of July 21, 2026. However, the low attack complexity and unauthenticated nature of the vulnerability make it straightforward to exploit if an attacker identifies an exposed FE HTTP service.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been identified in connection with this vulnerability.

What To Do

Apply the vendor-supplied patch from Apache for the affected Doris release as the primary remediation step. Prioritize patching given the critical CVSS score and the unauthenticated nature of the attack vector. As an immediate workaround, restrict network access to the Apache Doris FE HTTP service port using firewall rules or network access control lists, ensuring the administrative API is not reachable from untrusted networks or the public internet. Audit existing deployments to determine whether the FE HTTP port has been inadvertently exposed externally. Monitor FE HTTP access logs for unexpected or anomalous requests to administrative API paths as a detection signal, particularly from sources outside expected administrative IP ranges. Consult the Apache Doris security advisory for the specific affected version ranges and the patched release version.