Apache Doris SQL Injection Vulnerability CVE-2025-66336

TL;DR

Apache Doris version 0.6.1 patches a severe security flaw in its MCP Server. Specifically, an Apache Doris SQL injection bug allows attackers to bypass authentication checks. Consequently, unauthorized users can access restricted database metadata. This vulnerability requires immediate attention from system administrators.

Why It Matters

This flaw poses a significant risk to data privacy. Indeed, data architects rely on this real-time analytical database for high-throughput analysis. Attackers can view metadata outside their allowed database scope. Therefore, they might map out sensitive internal structures. Furthermore, anonymous attackers can exploit this if administrators disable authentication. Meanwhile, compromised metadata threatens the entire data ecosystem. Unauthorized access to this data can lead to severe compliance violations. As a result, organizations could face heavy fines if sensitive customer records are exposed.

How the Attack Works

The vulnerability occurs in a metadata query path within the MCP Server. A user-controlled database name goes directly into a SQL query. Moreover, the server executes this query without checking the caller’s authorization context. Consequently, attackers can manipulate the input to bypass SQL security validation completely. Additionally, the lack of input sanitization directly causes this authentication bypass. The system mistakenly trusts the interpolated database name. You can read the official advisory on the Apache mailing list for more details.

Affected Versions

The Apache Doris SQL injection vulnerability impacts the MCP Server specifically. It affects versions starting from 0.1.0 up to, but excluding, version 0.6.1.

Patch or Mitigation Steps

Administrators must apply the fix immediately to secure their databases. First, you should upgrade your MCP Server to version 0.6.1 or later. Users can get the latest secure release from the official download page. Importantly, applying this update resolves the missing authorization context issue. Finally, always keep database authentication enabled to reduce your attack surface. Ultimately, regular patching remains the best defense against known vulnerabilities. Database administrators should apply these security updates during their next scheduled maintenance window.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.