GHSA-pqrj-4gwg-h5f7

Source

https://github.com/advisories/GHSA-pqrj-4gwg-h5f7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-pqrj-4gwg-h5f7/GHSA-pqrj-4gwg-h5f7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pqrj-4gwg-h5f7

Aliases

Published

2026-06-22T09:30:45Z

Modified

2026-10-01T17:55:39Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Details

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.

Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-11T22:06:27Z",
    "nvd_published_at":  "2026-06-22T08:16:36Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / doris-mcp-server

Package

Name: doris-mcp-server; View open source insights on deps.dev
Purl: pkg:pypi/doris-mcp-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.6.1

Affected versions

0.*

0.4.2

0.5.0

0.5.1

0.6.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-pqrj-4gwg-h5f7/GHSA-pqrj-4gwg-h5f7.json"