CVE-2025-66336: Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

One of the server's metadata tools takes a database name and interpolates it directly into the SQL it sends to Doris. Because the string is not escaped, a crafted value can change the query. The query also runs without passing the caller's authorization context, so the server's own checks, including its SQL security validation, do not apply to it.

The attacker needs access to the MCP server. With authentication on, that means a valid account. With authentication disabled, any network client qualifies, which the advisory states directly. The CVSS vector requires low privileges, no user interaction and gives high confidentiality and integrity impact.

In practice the attacker can read metadata outside the database they were meant to see. The advisory names metadata exposure as the stated result. Because the query runs on the server's connection, it uses the server's Doris account rather than the caller's own rights. An AI agent connected to this server could also be steered to send such a value through prompt injection. The sources do not publish the exact tool name or payload.

The pip package doris-mcp-server before 0.6.1. Check the installed version:

pip show doris-mcp-server

Deployments that run with authentication disabled are the most exposed, since no account is needed.

Upgrade to doris-mcp-server 0.6.1 or later, as the advisory recommends.

pip install --upgrade doris-mcp-server==0.6.1

The upstream fix is pull request 68, titled "fix some security issues". It carries SQL injection tests, but its page does not describe the code change. The sources list no workaround. Until you upgrade, enable authentication, keep the server off untrusted networks, and give its Doris account the least access it needs.

Review the Doris audit log for metadata queries from the MCP server's account that reference database names you do not expect, or contain quotes, comment markers or extra clauses in the database-name position. Check the MCP server's access logs for tool calls whose database argument looks odd. Check whether the server runs with authentication disabled and who can reach its port.

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.

Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.