Apache Doris Updates Address Authentication Bypass and JDBC Code Execution
Tech GuruQuick Answer
Apache Doris has two different FE security boundaries to repair. CVE-2026-31377 permits unauthorized metadata-service access under affected network configurations and names fixes in 4.0.8 and 4.1.4. CVE-2026-96443 lets a privileged user exploit JDBC driver URL validation to execute code on the FE; its published affected range runs from 2.0.5 through 4.1.3. Do not assume the 4.0.8 metadata fix also resolves the JDBC issue.
Confirm Scope And Apply The Supported Fix
What to do now: inventory FE versions, access to internal metadata interfaces and accounts allowed to configure JDBC catalogs/drivers. Restrict those network paths and privileges while arranging a supported upgrade that covers both applicable CVEs. Coordinate the cluster change with owners of external catalogs and ingestion jobs.
Source recheck: October 2, 2026 UTC, using Apache CNA records and Doris release/configuration documentation. The branch-specific JDBC limitation above remains relevant when choosing the upgrade.
Scope And Authority
| Product scope | Apache Doris 2.0.0 through affected 4.0.x releases before 4.0.8 and 4.1.x before 4.1.4; the JDBC issue applies from 2.0.5 through 4.1.3 |
|---|---|
| Advisory | CVE-2026-31377 / CVE-2026-96443 |
| CVEs | CVE-2026-31377, CVE-2026-96443 |
| Authoritative release date | 2026-09-23 09:04:56.122 UTC |
| Authority revision date | 2026-09-23 15:14:21.119 UTC |
| Affected versions | Apache Doris 2.0.0 through affected 4.0.x releases before 4.0.8 and 4.1.x before 4.1.4; the JDBC issue applies from 2.0.5 through 4.1.3 |
| Fixed version | FE metadata authentication: 4.0.8 or 4.1.4 in the corresponding branch.JDBC URL validation: 4.1.4 release notes identify the hardening. A 4.0.x fix is not established by the cited JDBC record; obtain project/vendor confirmation for that branch. Select a supported release containing both applicable fixes. |
| CVSS base score | CVE-2026-31377: 7.5 (CVSS v3.1). Apache rates CVE-2026-96443 moderate without a numeric score in its CNA record. |
| CVSS severity | Moderate to Important |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The metadata flaw trusts client-supplied node information without adequate caller authentication; it is distinct from the JDBC flaw, which requires a privileged user. Older 1.2.x releases are excluded from this particular metadata defect, not endorsed as a secure downgrade. For JDBC-dependent deployments, review the 4.1.4 changes to driver validation, the removed upload API and the now-static driver URL allowlist before rollout; tightening validation can affect existing catalog provisioning.
What To Validate Now
- Inventory. Record each FE build, internal endpoint exposure, JDBC catalog/driver sources, privileged users and automation that uploads drivers or changes the URL allowlist.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Apache Doris 2.0.0 through affected 4.0.x releases before 4.0.8 and 4.1.x before 4.1.4; the JDBC issue applies from 2.0.5 through 4.1.3 Do not infer applicability from product family or severity alone.
- Remediate. Follow the supported cluster upgrade path for a release covering both applicable CVEs. Treat 4.0.8 as the named metadata fix only unless a separate JDBC fix is confirmed; test FE configuration and external-catalog compatibility before rollout.
- Validate. In staging, verify metadata access denial, approved JDBC catalog connectivity and driver provisioning. Check all FE nodes and application workflows; do not load an untrusted driver to test production susceptibility.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
