Apache Doris vulnerabilities

• apache doris Apache Doris: Improper Authentication in Frontend HTTP API CVE-2026-58319 9.1 CriticalJuly 14, 2026
• apache doris mcp server Apache Doris MCP Server: SQL injection leading the authentication bypass CVE-2025-66336 Fix available 8.1 HighJune 22, 2026
• apache doris mcp server Apache Doris MCP Server: MCP SQL inject CVE-2025-66335 Fix available 5.3 MediumApril 20, 2026
• apache doris mcp server, apache software foundation doris-mcp-server +1 more Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server CVE-2025-58337 Fix available 5.4 MediumNovember 5, 2025
• apache doris Apache Doris: allows admin users to read arbitrary files through the REST API CVE-2024-48019 5.4 MediumFebruary 4, 2025
• apache doris Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution CVE-2024-27438 9.8 CriticalMarch 21, 2024
• apache doris Apache Doris: Possible race condition CVE-2024-26307 5.3 MediumMarch 21, 2024
• apache doris Apache Doris: Timing Attack weakness CVE-2023-41313 9.8 CriticalMarch 12, 2024
• apache doris Apache Doris: Missing API authentication allowed DoS CVE-2023-41314 8.2 HighDecember 18, 2023
• apache doris, apache software foundation doris(incubating) +1 more Apache Doris hardcoded cryptography initialization CVE-2022-23942 Fix available 7.5 HighApril 26, 2022