CVE-2025-66336

The doris-mcp-server (Apache Doris MCP Server) is vulnerable to a SQL injection in a metadata query path. The root cause is the direct interpolation of a user-controlled database name into a SQL query, which is executed without the caller's authorization context. This allows an authenticated atta...