CVE-2025-66336

high Apache
CVSS v3 Base Score
8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
0.3%
Exploitation probability in 30 days
Top 74% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Confidentiality
High
Integrity
High
Availability
None
Published: June 22, 2026 (17 days ago)
Last Modified: June 26, 2026
Vendor: Apache
Source: NVD

Description

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope. Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

CWE

CWE-89

Affected Products

apache doris mcp server

References

🔗 lists.apache.org 🔗 www.openwall.com