Apache Doris FE HTTP REST API Missing Authentication Vulnerability

Technical Analysis

The vulnerability stems from missing or improperly enforced authentication checks on FE HTTP REST administrative endpoints in Apache Doris, a distributed MPP analytical database. An attacker with mere network reachability to the FE HTTP service (typically port 8030) could invoke administrative APIs to alter cluster state, trigger unauthorized operations, or disrupt availability, without needing valid credentials. The CVSS score of 9.1 reflects the low attack complexity and lack of required privileges combined with high impact to integrity and availability. Organizations that use Doris as a backend analytics or data warehouse layer for Retrieval-Augmented Generation (RAG) pipelines or AI agent data stores are at risk of cluster disruption or unauthorized data manipulation, which could poison or degrade the data agents retrieve and act upon, making this agent-relevant for any AI system depending on Doris-backed analytics for grounding or decision-making.

Affected Systems

Apache Doris Frontend (FE) nodes running versions prior to 3.1.0, specifically deployments exposing the FE HTTP REST administrative interface (default port 8030) to untrusted or broad network access.

Indicators of Compromise

• No specific IOCs published; monitor for anomalous unauthenticated requests to FE HTTP REST endpoints (e.g., /api/*, /rest/v2/* admin paths) from unexpected source IPs
• Unexpected cluster configuration changes or node state transitions in FE audit logs
• Unusual spikes in administrative API calls without corresponding authenticated sessions

Remediation Steps

1. 1

   Upgrade Apache Doris

   Upgrade all Apache Doris clusters to version 3.1.0 or later, where authentication is properly enforced on FE HTTP administrative APIs.

2. 2

   Restrict Network Exposure

   Limit network access to the FE HTTP service (port 8030 and related admin endpoints) to trusted internal networks and management hosts only, using firewalls or security groups.

3. 3

   Enforce Authentication Proxy

   If immediate upgrade is not possible, place a reverse proxy or API gateway in front of the FE HTTP interface that enforces authentication and access control.

4. 4

   Audit Cluster Activity

   Review FE audit logs for unauthorized administrative operations, unexpected configuration changes, or unusual API access patterns predating the upgrade.

5. 5

   Monitor Data Pipeline Integrity

   For organizations using Doris in RAG or analytics pipelines feeding AI agents, validate data integrity and cluster health after remediation to ensure no unauthorized modifications occurred.