Doris Mcp Server (Apache) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 8 known versions, newest CVE from 2026-06-22. Vendor: Apache.

CVEs of Doris Mcp Server

• CVE-2025-66336 - CVSS 8.1 (high), 2026-06-22: Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL…
• CVE-2025-66335 - CVSS 5.3 (medium), 2026-04-20: Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of…
• CVE-2025-58337 - CVSS 5.4 (medium), 2025-11-05: An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should…