CVE-2025-66335
Last modified
CVE-2025-66335 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Doris Mcp Server | >= 0.1.0, < 0.6.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-66335?
How severe is CVE-2025-66335?
How do I fix CVE-2025-66335?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6633A maliciously crafted RBG file, when parsed through Autodesk…7.8
- CVE-2025-66330App lock verification bypass vulnerability in the file manag…5.5
- CVE-2025-66331Denial of service (DoS) vulnerability in the office service.…5.5
- CVE-2025-66332Denial of service (DoS) vulnerability in the office service.…5.5
- CVE-2025-66333Denial of service (DoS) vulnerability in the office service.…5.5
- CVE-2025-66334Denial of service (DoS) vulnerability in the office service.…5.5
- CVE-2025-66336Apache Doris MCP Server contains a SQL injection vulnerabili…8.1
- CVE-2025-6634A maliciously crafted TGA file, when linked or imported into…7.8
- CVE-2025-66342A type confusion vulnerability exists in the EMF functionali…7.8
- CVE-2025-6635A maliciously crafted PRT file, when linked or imported into…7.8
- CVE-2025-66357CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with im…6.9
- CVE-2025-66359An issue was discovered in Logpoint before 7.7.0. Insufficie…6.1
Are you affected by CVE-2025-66335?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST