CVE-2025-66335

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/17/4	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:doris_mcp_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-20 14:16

Updated : 2026-06-17 09:56

NVD link : CVE-2025-66335

Mitre link : CVE-2025-66335

CVE.ORG link : CVE-2025-66335

JSON object : View

Products Affected

apache

doris_mcp_server

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-66335", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66335", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:17:08.608951Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Doris MCP Server", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "0.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-20T14:16:16.760", "references": [{"url": "https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/17/4", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected."}], "lastModified": "2026-06-17T09:56:41.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:doris_mcp_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95766A2C-71CC-4CC7-9F95-501B6ACC1E2F", "versionEndExcluding": "0.6.1", "versionStartIncluding": "0.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}