CVE-2025-66335

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66335
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66335.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66335
Aliases
Published
2026-04-20T13:27:27.764Z
Modified
2026-07-08T07:54:23.394814022Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Apache Doris MCP Server: MCP SQL inject
Details

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66335.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.1.0"
                },
                {
                    "fixed": "0.6.1"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/doris-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/apache/doris-mcp-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
81305ffbf97482e29abf70dc0ba9be928ed39df5
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.6.1"
        }
    ],
    "cpe": "cpe:2.3:a:apache:doris_mcp_server:*:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.4.2
0.5.1
0.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66335.json"