Vulnerabilidad · Publicado 23/09/2026
Una falla de autenticación impropia en el servicio de metadatos del Frontend (FE) de Apache Doris permite que atacantes remotos no autenticados accedan a endpoints internos de metadatos. La vulnerabilidad explota configuraciones de red específicas donde se confía en información del cliente sin validación suficiente. Afecta principalmente a sistemas de análisis de datos y datawarehouses en entornos cloud de México y LATAM que utilizan Doris para procesamiento analítico.
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Score: 7.5/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-287
Publicado en NIST NVD.