NewApp Monitoring is liveSign up free
AgentbeamBeta
AI agent vulnerability · Other MCP servers and tools

CVE-2025-66335: Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization

mediumCVSS 3.1 5.3GHSA-qhfq-gvvc-5q6q

Apache Doris MCP Server versions prior to 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Versions 0.6.1 and later are not affected.

Published Apr 20, 2026 · Updated Apr 24, 2026

Affected packages

doris-mcp-server

Ecosystem
PyPI
Affected
>= 0.1.0, < 0.6.1
Fixed in
0.6.1
Check
pip show doris-mcp-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Apache Doris MCP Server versions prior to 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Versions 0.6.1 and later are not affected.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries