CVE-2025-66335 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Doris MCP Server deployments should assess exposure and prioritize verification and remediation efforts to prevent potential data breaches or unauthorized access. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and prioritize remediation efforts.

Why it matters

Defenders should care about CVE-2025-66335 because it affects Apache Doris MCP Server versions earlier than 0.6.1, and may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions. Defenders responsible for Apache Doris MCP Server deployments should assess exposure and prioritize verification and remediation.

• Potential execution of unintended SQL statements
• Bypass of intended query validation and access restrictions
• Need for verification of affected versions and remediation
• Potential for data breaches or unauthorized access

Technical summary

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling. This vulnerability may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. Defenders should prioritize verifying and upgrading to version 0.6.1 or later, and restrict access to the MCP query execution interface to prevent potential data breaches or unauthorized access.

Defensive priority

Defenders should prioritize verifying and upgrading to version 0.6.1 or later, and restrict access to the MCP query execution interface.

Recommended defensive actions

• Verify and upgrade to version 0.6.1 or later
• Restrict access to the MCP query execution interface
• Monitor for suspicious activity on the MCP server
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability affects Apache Doris MCP Server versions earlier than 0.6.1. Defenders should verify the affected versions and assess exposure to prioritize verification and remediation efforts. The CVE record was published on 2026-04-20T14:16:16.760Z and has not been modified since then. The NVD vulnerability detail page provides additional information on the vulnerability,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.