PT-2025-45102 · Unknown · Doris Mcp Server

Liran Tal · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-58337

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Doris MCP Server versions prior to 0.6.0

Description An attacker with a valid read-only account can bypass the Doris MCP Server’s read-only mode due to improper access control. This allows modifications that should have been prevented by read-only restrictions. Attackers with read-only access may perform unauthorized modifications.

Recommendations Upgrade to version 0.6.0 as soon as possible.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-58337

GHSA-M35W-XX8C-6XC7

Affected Products

Doris Mcp Server

References · 11

• https://osv.dev/vulnerability/GHSA-m35w-xx8c-6xc7 · Vendor Advisory
• https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58337 · Security Note
• https://github.com/apache/doris-mcp-server · Note
• https://github.com/apache/doris-mcp-server/commit/5923cc1c8973069a6d54eca1948a10488cbf409e · Note
• https://t.me/CVEtracker/36611 · Telegram Post
• http://openwall.com/lists/oss-security/2025/11/04/5 · Note
• https://t.me/cveNotify/141788 · Telegram Post
• https://security.snyk.io/vuln/SNYK-PYTHON-DORISMCPSERVER-13835132 · Note
• https://t.me/cveNotify/141787 · Telegram Post