Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQ…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 20, 2026 · NIST NVD

   Detected

   Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

2. Oct 7, 2026 · NIST NVD

   Updated

   Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

Affected

• cpe apache/doris mcp serverversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-66335

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-66335

  Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution inte

  nvd.nist.gov

References

• Mailing List · openwall.com
• Vendor Advisory · lists.apache.org