CVE-2025-66336: Apache Doris MCP Server SQL injection in metadata query path

CVE-2025-66336 · Severity: high · CVSS 8.1 · Published 2026-06-22

Apache Doris MCP Server is a metadata access service that allows users to query database information. A SQL injection vulnerability allows authenticated users (or anonymous users if authentication is disabled) to bypass security controls and access metadata from databases they should not be able to reach. An attacker could view or modify sensitive database metadata across the entire system.

Technologies: doris-mcp-server (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-66336 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-66336 being exploited in the wild.
How severe is CVE-2025-66336?
High severity, with a CVSS score of 8.1, published 22 June 2026.
Which products and versions are affected?
doris-mcp-server (PyPI) < 0.6.1, ECOSYSTEM:introduced=0,fixed=0.6.1.
Is there a fix for CVE-2025-66336?
Yes. doris-mcp-server (PyPI): upgrade to 0.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66336 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-66336?
Check whether you run doris-mcp-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • doris-mcp-server (PyPI): upgrade to 0.6.1 or later
    pip install "doris-mcp-server>=0.6.1"

Technical details

The vulnerability is a classic SQL injection (CWE-89) in the metadata query path where user-supplied database names are directly concatenated into SQL queries without parameterization or escaping. The root cause is improper input validation and the execution of queries without passing the caller's authorization context, allowing privilege escalation. An authenticated attacker (or anonymous attacker if authentication is disabled) can craft malicious database name input to modify the SQL query logic and access metadata from databases outside their authorization scope. The attack requires network access to the MCP server endpoint and can be exploited with low complexity. The vulnerability has high impact on confidentiality (unauthorized metadata disclosure) and integrity (potential metadata modification). A fix is available in version 0.6.1 and later, implemented via PR #68 which adds proper parameterization and authorization context validation.

Affected products

  • Apache Doris MCP Server < 0.6.1

Identifiers

  • CVE-2025-66336
  • GHSA-pqrj-4gwg-h5f7
  • PYSEC-2026-4048

Timeline

  • 2026-06-22: disclosed: Vulnerability published in GitHub Advisory Database and NVD
  • 2026-06-22: patched: Fix available in version 0.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.