An authentication bypass in the Apache Doris Frontend meta service allows an unauthenticated attacker to reach internal metadata endpoints, exposing cluster information. The flaw arises from reliance on client‑supplied node data without proper verification, corresponding to CWE‑287. The impact involves potential disclosure of sensitive configuration and state data, as the attacker can query services intended for trusted nodes only.

Apache Doris versions 2.0.0 through 2.0.*, 2.1.0 through 2.1.*, 3.0.0 through 3.0.*, 3.1.0 through 3.1.*, and 4.0.0 before 4.0.8 as well as 4.1.0 before 4.1.4 are vulnerable; earlier 1.2.x releases are not affected.

The CVSS base score of 7.5 indicates high severity of an unauthorized token or credential bypass. The EPSS score of <1% indicates a very low probability of exploitation. The lack of a publicly listed KEV entry suggests no confirmed exploitation yet, but the vulnerability can be exercised by any remote party with network reach to the FE metadata interfaces under certain configurations. The condition requires that the endpoint accepts client‑supplied node information, but the specific protocol is not stated. Based on the description, it is inferred that remote network access to the FE meta service endpoints could enable the exploitation, although the exact attack vector is not explicitly defined.