Loading story…
Apache disclosed CVE-2026-58319, a critical improper authentication flaw in the Apache Doris Frontend (FE) HTTP REST administrative API. In affected versions from 2.1.0 up to but not including 3.1.0, certain administrative endpoints were reachable without proper authentication, allowing an unauthenticated attacker with network access to the FE HTTP service to perform unauthorized administrative operations.
Apache warned that successful exploitation could compromise cluster integrity and availability and trigger instability or denial of service. The project said users should upgrade to Apache Doris 3.1.0 or later to remediate the issue. The vulnerability was reported by Calvin Kirs of SelectDB and published through Apache and oss-security advisories.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-07-14, Apache disclosed CVE-2026-58319, a critical improper authentication flaw in certain Apache Doris Frontend HTTP REST administrative APIs. The issue affects Apache Doris versions 2.1.0 up to but not including 3.1.0 and could allow unauthenticated administrative actions that impact cluster integrity and availability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcelists.apache.org
Open sourceopenwall.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability tracked as **CVE-2026-56782** affects **Gorse** before version **0.5.10**, exposing the administrative `/api/dump` and `/api/restore` endpoints to unauthenticated remote access when `admin_api_key` is left empty. The issue is especially serious because the empty key is reported as the default configuration, making internet-exposed deployments vulnerable without additional hardening. The flaw has been rated **9.8** under CVSS 3.1 and **9.3** under CVSS 4.0. Successful exploitation allows attackers to export the entire database, including user records, items, feedback data, and potentially personally identifiable information, or to overwrite the dataset entirely, creating both confidentiality and integrity risks. Advisories recommend upgrading to **Gorse 0.5.10 or later**, setting a strong administrative API key, restricting access to the affected endpoints, and reviewing whether sensitive data may already have been exposed.
Jul 1, 2026
Security researcher Orange Tsai disclosed **Confusion Attacks**, a set of architectural vulnerabilities in Apache HTTP Server (`httpd`) caused by modules inconsistently interpreting and modifying shared request fields. The flaws—covering Filename, DocumentRoot, and Handler Confusion—were assigned nine CVEs, including `CVE-2024-38472`, `CVE-2024-38473` through `CVE-2024-38477`, and `CVE-2024-39573`. Depending on configuration, exploitation can permit authentication or access-control bypasses, arbitrary local-file and source-code disclosure, SSRF, XSS, local socket access, and possible remote code execution. Apache addressed the reported issues in **httpd 2.4.60**. Risk is highest where deployments use unsafe `RewriteRule` directives, PHP-FPM or `mod_proxy`, CGI-style handlers or redirects, permissive directory and symlink settings, or accessible local package files. Apache's `mod_rewrite` guidance documents hardening changes associated with `CVE-2024-38474` and `CVE-2024-38475`; administrators should avoid enabling `UnsafeAllow3F` and `UnsafePrefixStat` unless they have verified that untrusted input cannot control rewritten query strings or filesystem paths.
Sep 3, 2026
Several critical vulnerabilities have been disclosed in widely used enterprise products, each posing significant security risks. A flaw in ASUSTOR devices (CVE-2025-13051) allows local attackers to escalate privileges to SYSTEM via DLL hijacking, potentially granting full control over affected systems. Separately, Apache Causeway is impacted by a remote code execution vulnerability (CVE-2025-64408) that enables authenticated attackers to execute arbitrary code through Java deserialization, threatening the integrity of applications built on this framework. Additionally, the D-Link DIR-878 router, now at end-of-life, contains three unpatched remote code execution flaws that allow unauthenticated attackers to run commands remotely, leaving users exposed with no forthcoming security updates. Apache Tomcat is also affected by a critical path traversal vulnerability (CVE-2025-55752), which can be exploited under certain rewrite configurations to access sensitive directories, especially when HTTP PUT is enabled. Organizations using these products should urgently assess their exposure and apply mitigations or seek alternatives where patches are unavailable.
Jun 29, 2026