CVE-2025-66336

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66336
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66336.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66336
Aliases
Published
2026-06-22T06:55:17Z
Modified
2026-09-11T22:25:59Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Apache Doris MCP Server: SQL injection leading the authentication bypass
Details

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.

Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66336.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.1.0"
                },
                {
                    "fixed": "0.6.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/doris-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/apache/doris-mcp-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
81305ffbf97482e29abf70dc0ba9be928ed39df5
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:doris_mcp_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.1.0"
        },
        {
            "fixed": "0.6.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*
0.4.2
0.5.1
0.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66336.json"