CVE-2025-66335 — Apache Doris MCP Server: MCP SQL inject

Description (CNA)

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Doris MCP Server	affected 0.1.0 before 0.6.1

CWE

CWE-89

References

https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/04/17/4

CISA-ADP

No English description supplied.

No references supplied.