doris-mcp-server vulnerabilities
CVEs whose affected-version data names the doris-mcp-server package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2025-66336High· 8.1Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path
Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path
▾ Twilightdoris-mcp-server · doris-mcp-serverEPSS 0.56%via OSV
CVE-2025-66335Medium· 5.3Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization
Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization
▾ Sunlitdoris-mcp-server · doris-mcp-serverEPSS 0.66%via OSV
CVE-2025-58337MediumApache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode
Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode
▾ Sunlitdoris-mcp-server · doris-mcp-serverEPSS 0.35%via OSV