PT-2025-45743 · Pypi · Doris Mcp Server

Published 2025-11-05 · Updated 2025-11-05

OSV

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions.

Impact:

Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.

Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

GHSA-M35W-XX8C-6XC7

Affected Products

Doris Mcp Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-58337 · Security Note
• https://osv.dev/vulnerability/GHSA-m35w-xx8c-6xc7 · Vendor Advisory
• https://github.com/apache/doris-mcp-server · Note
• https://github.com/apache/doris-mcp-server/commit/5923cc1c8973069a6d54eca1948a10488cbf409e · Note
• https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h · Note
• http://openwall.com/lists/oss-security/2025/11/04/5 · Note
• https://security.snyk.io/vuln/SNYK-PYTHON-DORISMCPSERVER-13835132 · Note