CVE-2025-66336

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope. Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2026-06-22

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

Affected

• apache:doris_mcp_server

Packages (OSV)

References

• https://lists.apache.org/thread/4l4v3m7ofwrgp4s4s98pjb5l03fcrzo2
• http://www.openwall.com/lists/oss-security/2026/06/22/1

Check your stackJSON