VULNERABILITY INTELLIGENCE

CVE-2025-66335

CVSS score5.3 MEDIUM
EPSS probability0.66%
CISA KEVNot currently listed
Published2026-04-20
Last modified2026-10-07
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

Weakness classification

  • security@apache.org: CWE-89

Primary references