Apache Doris — CVE-2026-58319 (Critical)

Date Jul 14, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Apache · Doris

CVE CVE-2026-58319

Critical vendor advisory CVE-2026-58319

Summary

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.1) in Apache Doris. Patch or mitigate promptly. EPSS percentile: 17%.

Operator check

Review CVE-2026-58319 in your asset inventory. Apply patches per vendor guidance and verify Doris is not exposed. CVSS score: 9.1. EPSS probability: 0.3%; percentile: 17%.

Sources

NVD — CVE-2026-58319 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed