CVE-2025-66335General(apache / doris_mcp_server)

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch apache doris_mcp_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://lists.apache.org/thread/odp0fyyst8kxm7hhm9z4d1snh1y4hjpy

Other references

http://www.openwall.com/lists/oss-security/2026/04/17/4

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

doris_mcp_server

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 2 classified signals
Disclosure: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-05-12)
4 total mentions across 3 days

Affected systems

Vendors

apache

Products

doris_mcp_server

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

General

250.0%

Patch

125.0%

Disclosure

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-17	1	General1
2026-04-19	1	Patch1
2026-05-12	2	Disclosure1General1

Full discourse4 posts

Akamai Security Intelligence Group@akamai_research149d
Disclosure
Akamai researchers uncover vulnerabilities in three MCP servers. Learn about CVE-2025-66335 and how to secure your AI-to-backend connection. https://ow.ly/Tki250YYqEE
Post summary
The statement reports that Akamai researchers have identified vulnerabilities in MCC servers (CVE‑2025‑66335) and directs readers to a link for further information, but it does not provide technical details, exploits, or mitigation steps.
06083938
25.5K followersView on X
Tomer Peled@TomerPeled92149d
General
Very excited to finally share my research into MCP backends and CVE-2025-66335 read more here: https://www.akamai.com/blog/security-research/2026/may/one-fluke-3-pattern-mcp-back-end-vulnerabilities #CVE #CyberSecurity #cyber #research
Post summary
The tweet announces research on MCP backend vulnerabilities and references CVE‑2025‑66335, but offers no specific technical or exploitation details.
010011.1K
227 followersView on X
Open Source Security mailing list@oss_security173d
Patch
CVE-2025-66335: Apache Doris MCP Server: MCP SQL inject https://www.openwall.com/lists/oss-security/2026/04/17/4 may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.
Post summary
Apache Doris MCP Server CVE-2025-66335 is an SQL injection flaw that bypasses query validation; upgrading to version 0.6.1 or later eliminates the risk.
00010549
4.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds174d
General
CVE-2025-66335 CVE-2025-66335 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-66335 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The entry merely repeats the CVE ID and provides generic links to a vulnerability database and subscription service without offering additional details or context.
00000199
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	doris_mcp_server	-	-	-

Explore more

Back to dashboard apache CVEs doris_mcp_server vulnerabilities

What researchers are saying

CVE-2025-66335

Akamai Security Intelligence Group@akamai_researchDisclosure

The statement reports that Akamai researchers have identified vulnerabilities in MCC servers (CVE‑2025‑66335) and directs readers to a link for further information, but it does not provide technical details, exploits, or mitigation steps.

Tomer Peled@TomerPeled92General

The tweet announces research on MCP backend vulnerabilities and references CVE‑2025‑66335, but offers no specific technical or exploitation details.

Open Source Security mailing list@oss_securityPatch

Apache Doris MCP Server CVE-2025-66335 is an SQL injection flaw that bypasses query validation; upgrading to version 0.6.1 or later eliminates the risk.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The entry merely repeats the CVE ID and provides generic links to a vulnerability database and subscription service without offering additional details or context.