CVE-2025-66336: Apache Doris MCP Server SQL Injection Vulnerability (CVSS 8.1)

Technical summary

CVE-2025-66336 is a SQL injection flaw (CWE-89) in Apache Doris MCP Server affecting metadata query operations. The vulnerability stems from unsanitized interpolation of a user-controlled database name parameter directly into a SQL query string. The query is executed without propagating the caller's authorization context, meaning the injection point bypasses row-level security and scope boundaries that would normally limit database access. This allows authenticated users to craft queries that access metadata outside their intended namespace, or unauthenticated users if the deployment has authentication disabled.

Business impact

This vulnerability creates a significant data exposure risk for organizations running Apache Doris MCP Server. An insider or external attacker with network access could enumerate and exfiltrate metadata from databases they lack permission to view, potentially revealing table schemas, column definitions, and other structural information used in data governance and security planning. In multi-tenant environments, this could lead to cross-tenant information disclosure. The impact is heightened in deployments where authentication is disabled, which may be the case in isolated development or lab environments that later connect to production.

Affected systems

Apache Doris MCP Server versions prior to 0.6.1 are affected. The vulnerability impacts any deployment, regardless of authentication posture, though the risk surface is broader when authentication is disabled. Organizations should verify their Doris version and check whether any instances are connected to production or sensitive data environments.

Exploitability

The vulnerability requires network access to the Doris MCP Server endpoint (AV:N). Exploitation is straightforward—no complex exploitation technique is needed (AC:L). An attacker must be either an authenticated user (PR:L) or have access in an authentication-disabled environment. No user interaction is required (UI:N). The flaw is a direct code path that does not depend on race conditions or timing. Given the simplicity of SQL injection and the lack of authentication barriers in some deployments, this should be treated as readily exploitable by competent attackers.

Remediation

Upgrade Apache Doris MCP Server to version 0.6.1 or later. This version contains fixes that properly sanitize or parameterize the database name parameter and restore authorization context validation. Before patching, restrict network access to the MCP Server to trusted callers only, disable or strengthen authentication if currently disabled, and monitor query logs for suspicious metadata access patterns.

Patch guidance

Consult the official Apache Doris project release notes and security advisories for version 0.6.1 to confirm patch availability and any upgrade prerequisites. Test the patch in a non-production environment first, particularly if your deployment includes custom configurations or integrations with other tools. Verify that the patch is applied uniformly across all MCP Server instances in your infrastructure. After upgrade, validate that metadata queries are properly scoped and that authorization checks are enforced as expected.

Detection guidance

Monitor MCP Server query logs for SQL patterns that reference database names not typically accessed by known applications or users. Look for queries that include unusual string concatenation or escaping attempts around database name parameters. Network intrusion detection rules should flag unusual volumes of metadata queries from single users or sessions. Implement query audit logging if not already enabled, and correlate access logs with known user roles and their authorized database scopes. Test your detection by running authorized metadata queries and confirming they are logged and auditable.

Why prioritize this

With a CVSS 3.1 score of 8.1 (HIGH) and a vector indicating network access, low complexity exploitation, and high confidentiality and integrity impact, this vulnerability warrants prompt action. The low barrier to exploitation (authenticated or unauthenticated depending on configuration) and the direct path to unauthorized data access elevate risk, particularly in regulated industries handling sensitive data. Although not yet tracked in the CISA KEV catalog, organizations should prioritize remediation based on their own data classification and exposure posture.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) Network-accessible attack surface (AV:N), (2) Low attack complexity requiring no special tools or conditions (AC:L), (3) Privileges required only at the user level (PR:L), indicating insider and low-privilege threats are in scope, (4) No user interaction needed (UI:N), and (5) High confidentiality and integrity impact (C:H, I:H) from unauthorized metadata access and potential query manipulation. The score does not account for organizational factors like data sensitivity or deployment context—assess those separately in your risk model.

Frequently asked questions