doris_mcp_server vulnerabilities
CVEs whose affected-version data names the doris_mcp_server package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2025-66336High· 8.1Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path
Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization cont…
▾ Twilightapache · doris_mcp_serverEPSS 0.56%via NVD
CVE-2025-66335Medium· 5.3Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restri…
Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restri…
▾ Sunlitapache · doris_mcp_serverEPSS 0.66%via NVD