Description

An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-23T09:17:08.380Z",
  "pubdate": "2026-09-23T09:17:08.380Z",
  "executiveSummary": "The Apache Doris Frontend (FE) meta service contains an improper authentication vulnerability stemming from a reliance on client-supplied node information. This security flaw allows unauthenticated remote attackers to bypass access controls and interact with internal metadata service endpoints.\nThe vulnerability affects multiple major versions of Apache Doris, specifically 2.0.x, 2.1.x, 3.0.x, 3.1.x, as well as versions 4.0.0 through 4.0.7 and 4.1.0 through 4.1.3.\nSuccessful exploitation permits unauthorized access to sensitive cluster metadata, which could lead to information disclosure regarding the internal structure and configuration of the Doris cluster. The attack requires network reachability to the vulnerable FE meta service interface but does not require prior authentication or elevated privileges. Given the critical nature of cluster metadata, this exposure poses a significant risk to the overall confidentiality and integrity of the database environment. Users must upgrade to the patched versions to eliminate the underlying trust issue.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure authentication mechanism within the Apache Doris Frontend (FE) meta service. The service incorrectly delegates authentication validation to client-supplied node metadata. By trusting headers or parameters provided by the requesting party to identify the node, the service fails to verify the authenticity of the requester, effectively bypassing intended security controls.\nThe vulnerability occurs within the FE metadata service endpoints. Because the service relies on mutable client-supplied data rather than a secondary validation layer (such as shared secrets, TLS certificate verification, or internal token-based authentication), an attacker can craft requests that spoof valid node identities. When the service receives these requests, it grants the attacker access to privileged metadata operations.\nExploitation follows a straightforward path: 1. The attacker performs network reconnaissance to identify the exposed FE meta service port. 2. The attacker crafts an HTTP request targeting an internal metadata endpoint, injecting the necessary node identification headers that the FE service expects to see from a legitimate cluster node. 3. The service processes the request, matches the spoofed node information against its internal logic, and mistakenly authorizes the session. 4. Once access is granted, the attacker can query the metadata service to extract sensitive cluster information, such as configuration details, internal state, or node topologies.\nThis issue is explicitly scoped to versions 2.0.x, 2.1.x, 3.0.x, 3.1.x, 4.0.0-4.0.7, and 4.1.0-4.1.3. Versions 1.2.x and earlier are not impacted by this header-trust mechanism. The vulnerability allows for unauthorized information disclosure, and depending on the specific endpoint exposed, potentially other unauthorized actions related to cluster meta-management. The lack of cryptographic verification for node-to-node communication in these endpoints is the primary architectural flaw enabling this bypass. The attack requires no authentication, allowing any actor with network connectivity to the FE port to exploit the service."
}