VulnSocial

CVE-2025-66336General(apache / doris_mcp_server)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache doris_mcp_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope. Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • doris_mcp_server

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-06-22); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
apache
Products
doris_mcp_server

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-22: 2Mentions · 2026-06-25: 1Patch / Workaround · 2026-06-22: 1Technical Details · 2026-06-22: 1Technical Details · 2026-06-25: 106-2206-25
Signal classification3 categories
General
133.3%
Patch
133.3%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-222
General1Patch1
2026-06-251
Disclosure1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2025-66336: Apache Doris MCP Server: SQL injection leading to authorization bypass https://www.openwall.com/lists/oss-security/2026/06/22/1 Severity: important

    Post summary

    The text announces CVE‑2025‑66336 and describes an SQL injection flaw in Apache Doris MCP Server that allows authorization bypass, with an important severity rating.

    00010505
    4.7K followersView on X
  • Daily CyberSecurity@the_yellow_fall
    Patch

    A critical Apache Doris SQL injection vulnerability identified as CVE-2025-66336 allows attackers to bypass authentication. Upgrade your servers now. #ApacheDoris #SQLInjection #CVE202566336 #CyberSecurity #DatabaseSecurity https://securityonline.info/apache-doris-sql-injection-cve-2025-66336 https://t.co/8ASU8wF3Th

    Post summary

    The post alerts users to a critical SQL injection flaw in Apache Doris (CVE‑2025‑66336) that bypasses authentication, urging immediate server upgrades.

    00001631
    12.3K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2025-66336 CVE-2025-66336 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-66336

    Post summary

    The content only lists the CVE identifier and a link to a vulnerability details page, offering no additional information.

    00000128
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachedoris_mcp_server---

Explore more

Back to dashboardapache CVEsdoris_mcp_server vulnerabilities