CVE-2026-111692

Summary

The vulnerability allows attackers to bypass authentication by forging admin session tokens using a hardcoded HMAC secret, enabling full administrative access to protected API routes including the Doris SQL query API.

Exploitability

Very easy to exploit with no prerequisites - attackers only need to know the service is running and can make requests to forge valid admin tokens using the default dev-secret.

Blast radius

High impact across all systems using this component, potentially allowing full database access and administrative control over protected API endpoints.

Detection

Monitor for unauthorized access attempts to /webapi routes with admin privileges, particularly those involving JWT tokens signed with the default dev-secret signature.

Prioritized remediation

Upgrade to version 0.1.11 or later to fix the hardcoded HMAC secret issue in JwtTokenService.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.