Report: CVE-2025-66335 - Apache Doris MCP Server: MCP SQL inject - Analysis

Report: CVE-2025-66335 - Apache Doris MCP Server: MCP SQL inject - Analysis

CVE ID :CVE-2025-66335 Published : April 20, 2026, 2:16 p.m. | 40 minutes ago Description :Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE Details

Published
April 20, 2026
Affected Product: Apache