Review reviewHigh

CVE-2025-66336

Apache Software Foundation Apache Doris MCP Server, doris mcp server

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope. Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

CVSS: 8.1
EPSS: 0.56%
CISA KEV: Not listed
Published: 2026.06.22

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.56%

Technical severityCVSS 8.1

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Doris MCP Server, doris mcp server
Affected versions: 0.1.0, >= 0.1.0 < 0.6.1
Fixed versions: 0.6.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Doris MCP Server, doris mcp server and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-89