Skip to content
Hermes Codex

CVE-2026-31377: Apache Doris Frontend Meta Service Unauthenticated Access and Metadata Exfiltration

HERMES

HERMES THREAT SCORE & ENTERPRISE RISK EXPOSURE

Target: Enterprise Real-Time Data Warehouses, OLAP Analytics Engines & MPP Clusters
Confidence: 94%
84 / 100
HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 15 / 20
Weaponization 16 / 20
Exposure 16 / 20
Prevalence 17 / 20
Impact 17 / 20
Exploit Maturity 17 / 20
Attack Chain Potential 18 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-31377 at 7.5 High with an impact limited to confidentiality. Hermes Threat Score elevates this to 84 (HIGH). Apache Doris is deployed as an enterprise MPP data warehouse storing sensitive analytics, telemetry, and transactional summaries. Exposing internal FE metadata allows adversaries to extract schema structures, table layouts, partition token hashes, and internal node IP topology, providing the reconnaissance foundation for targeted data exfiltration or subsequent cluster takeover.

HASS

HASS AGENTIC SEVERITY & PERIMETER BOUNDARY IMPACT

Target: Apache Doris FE Internal Meta Service & Node Discovery Protocol
Confidence: 90%
52 / 100
MODERATE

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 12 / 20
Tool Access 14 / 20
Privilege 11 / 15
Persistence 8 / 15
External Impact 7 / 15
Propagation 0 / 15
⚖️ Divergence & Operational Rationale

Agentic database querying frameworks and text-to-SQL agents rely on database schema catalogs to synthesize queries. Exploiting unauthenticated metadata endpoints allows an attacker or rogue agent to reconstruct the entire analytical data model and poison downstream agent semantic decision contexts.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-31377: Apache Doris Frontend Meta Service Unauthenticated Access and Metadata ExfiltrationVULNERABILITY

Connected Nodes: 3
Active Relationships (Outgoing)
→ affectsPRODUCTApache Doris MPP Database
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Apache Doris MPP Database documented in Hermes dossier.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-003: Tool Parameter Tampering & Built-in Bypass
92% VERY_HIGH

Adversarial subversion of structured tool execution arguments (SQL, Shell, Filepath) passed from an LLM agent to host OS tools or MCP endpoints.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-31377 weaponizes the agentic attack pattern formalized under AAP-003.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-006: Inter-Agent Semantic Message Spoofing
92% VERY_HIGH

Exploitation of unauthenticated, unsigned inter-agent communication channels to forge delegation directives, impersonate orchestrator agents, and command worker subagents.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-31377 weaponizes the agentic attack pattern formalized under AAP-006.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

In an Apache Doris cluster, the Frontend (FE) nodes run a Java daemon managing an in-memory catalog, BDB-JE (Berkeley DB Java Edition) replication log, and external client query routing.

ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-31377Apache Doris Advisory / NIST NVD Entry
Vulnerability ClassImproper Authentication (CWE-287) / Missing Authentication (CWE-306)Unauthenticated extraction of cluster state and database schemas
Vulnerable ComponentDoris FE Meta Service (MetaServer / HttpServer port 8030 / RPC 9010)Node synchronization and metadata export servlets
Exploitation VectorDirect HTTP/RPC requests with fabricated node metadata headersBypass of administrative authorization checks
Privileges RequiredNone (PR:N)Pre-authentication flaw accessible over network
Privileges ObtainedRead access to cluster metadata, schemas, and topologyExfiltration of tenant schemas, partition layouts, and node addresses
Affected Versions2.0.0–2.0., 2.1.0–2.1., 3.0.0–3.0., 3.1.0–3.1., 4.0.0–4.0.7, 4.1.0–4.1.3Enterprise real-time analytics clusters, cloud data warehouses
Fixed UpdatesApache Doris 4.0.8 and 4.1.4Enforces cluster authentication token verification on all meta APIs

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

Client-Supplied Node Verification Flaw

Section titled “Client-Supplied Node Verification Flaw”

The FE daemon provides internal HTTP endpoints (under /rest/v1/meta/ or HttpServer port 8030) and Thrift RPC services (port 9010) used by follower and observer nodes to synchronize image files and query catalog snapshots.

In vulnerable versions, the servlet dispatcher verified incoming synchronization requests by checking whether the client request supplied a recognized node identity string (such as node_name or client_fe_ip), without requiring an authenticated session or validating the shared cluster authentication token (auth_token):

// Vulnerable authentication check in Doris FE MetaAction / NodeSyncHandler
public class MetaAction extends RestBaseAction {
    @Override
    public void execute(BaseRequest request, BaseResponse response) {
        String clientNodeName = request.getHeader("X-Doris-Node-Name");
        String requestedImageVersion = request.getParameter("version");


        // FLAW: The service simply checks whether clientNodeName matches a registered node,
        // but DOES NOT verify the caller's cryptographic identity or cluster auth token!
        if (Catalog.getCurrentCatalog().isRegisteredNode(clientNodeName)) {
            // Unauthenticated caller claiming to be "fe_follower_1" is granted access!
            File imageFile = Storage.getLatestMetaImageFile();
            response.sendFile(imageFile);
            return;
        }


        // In other endpoints, missing validation allowed direct catalog schema queries
        sendMetadataDump(request, response);
    }
}

Because the list of registered FE node names is often predictable or exposed via standard discovery banners (e.g. fe_1, follower_node), an attacker can simply send an HTTP GET request with a spoofed header, prompting the FE to return sensitive metadata images and internal schema definitions.

3. Attack Vectors & Forensic Execution Flow

Section titled “3. Attack Vectors & Forensic Execution Flow”
sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker
    participant FE as Apache Doris FE (TCP 8030 / 9010)
    participant Catalog as FE In-Memory Catalog & BDB-JE
    participant Storage as Cluster Storage / Metadata Image
    participant Warehouse as Analytical Database Tables


    Attacker->>FE: Connect to HTTP port 8030 / RPC 9010
    Attacker->>FE: GET /rest/v1/meta/image (Header: X-Doris-Node-Name: fe_node_1)
    FE->>Catalog: isRegisteredNode("fe_node_1") -> Returns TRUE (blind trust)
    FE->>Storage: Read latest metadata checkpoint image
    Storage-->>FE: Stream serialized catalog data (schemas, partition hashes, tokens)
    FE-->>Attacker: 200 OK (Full database schema & cluster topology payload)
    Attacker->>Attacker: Reconstruct database schema, user accounts & table structures
    Attacker->>Warehouse: Launch targeted SQL injection / data exfiltration on Backend nodes
  1. Network Discovery: The attacker identifies an accessible Apache Doris cluster with Frontend service ports (TCP 8030 or 9010) exposed to the network.
  2. Node Identity Spoofing: The adversary crafts an HTTP request to the meta synchronization endpoint, inserting a header declaring the caller to be a known cluster follower node.
  3. Authentication Bypass: The FE endpoint validates that the claimed node name exists in the catalog but fails to authenticate the requester’s cryptographic credentials.
  4. Metadata Dump Exfiltration: The FE streams the latest serialized metadata image or catalog schema to the unauthenticated attacker.
  5. Reconnaissance Exploitation: The attacker parses the metadata dump to discover internal table schemas, confidential column definitions, partition layouts, and internal backend node IP addresses, setting up targeted downstream attacks.

4. Forensic Investigation & Incident Response

Section titled “4. Forensic Investigation & Incident Response”

DFIR analysts investigating potential exploitation of CVE-2026-31377 should review the Frontend logging directories:

Triage Commands & Log Inspection

Section titled “Triage Commands & Log Inspection”
Terminal window
# 1. Audit Doris FE HTTP access logs for unauthorized calls to meta endpoints
grep -E "/rest/v1/meta|/image|/dump" /opt/apache-doris/fe/log/fe.audit.log


# 2. Inspect FE application logs for foreign node synchronization attempts
grep -E "MetaAction|NodeSync|reject|download image" /opt/apache-doris/fe/log/fe.log | grep -v "127.0.0.1"


# 3. Check for external network connections on Frontend management ports
ss -tanp | grep -E "8030|9010|9020|9030"


# 4. Review registered cluster node list via MySQL client
mysql -h 127.0.0.1 -P 9030 -u root -e "SHOW FRONTENDS; SHOW BACKENDS;"


# 5. Examine cluster configuration for authentication token enforcement
grep -E "auth_token|enable_token_check" /opt/apache-doris/fe/conf/fe.conf

5. Threat Hunting & Detection Engineering

Section titled “5. Threat Hunting & Detection Engineering”
title: Apache Doris Frontend Meta Service Unauthorized Access
id: 31377c01-doris-fe-meta-auth-bypass
status: experimental
description: Detects suspicious or external HTTP requests targeting Apache Doris Frontend metadata endpoints.
author: Hermes Codex Detection Engineering
date: 2026-09-24
logsource:
  category: webserver
  product: apache_doris
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/rest/v1/meta'
      - '/rest/v1/image'
      - '/rest/v1/dump'
  filter_internal:
    c-ip|in:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.1'
  condition: selection_uri and not filter_internal
falsepositives:
  - Legitimate cross-datacenter cluster synchronization over public or partner subnets without VPN encapsulation.
level: high
tags:
  - attack.reconnaissance
  - attack.t1592
  - cve.2026-31377

6. Remediation & Hardening Roadmap

Section titled “6. Remediation & Hardening Roadmap”

Upgrading Apache Doris

Section titled “Upgrading Apache Doris”

Upgrade all Frontend and Backend nodes to Apache Doris 4.0.8 or 4.1.4:

  • For 4.0.x branches: Upgrade to 4.0.8 or higher.
  • For 4.1.x branches: Upgrade to 4.1.4 or higher.

Operational Mitigations

Section titled “Operational Mitigations”
  1. Enable Cluster Auth Token: Configure a strong, random cluster token in fe.conf: 
    auth_token = <generated_secure_random_hex_string_64_bytes>
    enable_token_check = true
  2. Network Perimeter Isolation: Strictly isolate Doris FE ports (8030, 9010, 9020, 9030) using host-level firewalls (iptables / nftables) or private VPC subnets. Only authorized FE/BE nodes should have network access to ports 8030 and 9010.
  3. Audit User Grants & Logging: Ensure fe.audit.log is forwarded to a centralized SIEM for real-time monitoring of unexpected administrative queries.

7. Correlated Research & Internal References

Section titled “7. Correlated Research & Internal References”

Sources & References

Section titled “Sources & References”