Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-96443 EUVD-2026-85178GHSA-h927-w38j-3g6x

Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Doris

Description

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Doris 2.0.5 – ≤ 4.1.3 —

References