PYSEC-2026-4048 Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

PT-2026-105805

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

PT-2026-82722

RedisChatMemoryRepository.findByMetadata builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape, unlike get, clear, and findByTimeRange in the same class which do escape their inputs. An application that passes user-controlled values to...

PYSEC-2026-858 OpenStack Nova Router metadata queries are not restricted by tenant

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by 1...

GHSA-PQRJ-4GWG-H5F7 Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

CVE-2025-66336

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

EUVD-2025-210295

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

CVE-2025-66336

The doris-mcp-server (Apache Doris MCP Server) is vulnerable to a SQL injection in a metadata query path. The root cause is the direct interpolation of a user-controlled database name into a SQL query, which is executed without the caller's authorization context. This allows an authenticated atta...

CVE-2025-66336 Apache Doris MCP Server: SQL injection leading the authentication bypass

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

CVE-2025-66336: Improper Neutralization of Special Elements used in an SQL Command

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

EUVD-2023-35298

Malicious code in bioql PyPI...

CVE-2020-9483

Resolved When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to...

com.webank.wedatasphere.linkis:linkis-engineplugin-hive (1.0.2), org.apache.hive:hive-pre-upgrade (>=4.0.0-alpha-2, <=4.0.0-beta-1) +3 more potentially affected by CVE-2024-29869 via org.apache.hive:hive-exec (2.3.3)

org.apache.hive:hive-exec MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-exec and may be impacted: - com.webank.wedatasphere.linkis:linkis-engineplugin-hive 1.0.2 - org.apache.hive:hive-pre-upgrade...

com.webank.wedatasphere.linkis:linkis-engineplugin-hive (1.0.2), org.apache.hive:hive-llap-client (2.3.3) +5 more potentially affected by CVE-2024-23953 via org.apache.hive:hive-llap-common (2.3.3)

org.apache.hive:hive-llap-common MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive-llap-common and may be impacted: - com.webank.wedatasphere.linkis:linkis-engineplugin-hive 1.0.2 - org.apache.hive:hive-llap-clien...

Arbitrary File Read

org.apache.linkis, linkis-metadata-query-service-jdbc is vulnerable to Arbitrary File Read. The vulnerability is due to insufficient parameter filtering in the DataSource Manager Module, allowing an attacker to configure malicious MySQL JDBC parameters to read arbitrary files from the server...

Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

Affected versions: - Apache Linkis Metadata Query Service JDBC 1.5.0 before 1.7.0 Description: In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read...

GHSA-8CVQ-3JJP-PH9P Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

Affected versions: - Apache Linkis Metadata Query Service JDBC 1.5.0 before 1.7.0 Description: In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read...

CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...