Apache Software Foundation Apache Doris vulnerabilities

4 CVEs affecting Apache Software Foundation Apache Doris, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96443, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-31377, published 2026-09-23. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected…
CVE-2026-72524, published 2026-09-14. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris:…
CVE-2026-68570, published 2026-09-14. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of…
CVE-2026-96443, published 2026-09-23. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.