PT-2026-33643 · Apache · Apache Doris Mcp Server

Published 2026-04-19 · Updated 2026-05-28 · CVE-2025-66335

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Doris MCP Server versions prior to 0.6.1

Description An improper neutralization flaw in query context handling within the MCP query execution interface may allow the execution of unintended SQL statements. This can lead to the bypass of intended query validation and access restrictions.

Recommendations Update to version 0.6.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-66335

GHSA-QHFQ-GVVC-5Q6Q

Affected Products

Apache Doris Mcp Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-66335 · Security Note
• https://osv.dev/vulnerability/GHSA-qhfq-gvvc-5q6q · Vendor Advisory
• https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy · Vendor Advisory
• https://github.com/apache/doris-mcp-server/releases/tag/0.6.1 · Note
• https://github.com/apache/doris-mcp-server · Note
• http://openwall.com/lists/oss-security/2026/04/17/4 · Note
• https://reddit.com/r/mcp/comments/1tqduia/akamai_found_3_mcp_database_flaws_this_month_is · Reddit Post
• https://twitter.com/oss_security/status/2045901994603294975 · Twitter Post
• https://twitter.com/TomerPeled92/status/2054291419703943434 · Twitter Post