Am I affected by Apache Doris MCP Server SQL Injection via metadata query path? What should I do?
Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path.
Affected: pip/doris-mcp-server < 0.6.1. Fixed in: 0.6.1. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2025-66336-apache-doris-mcp-server (opens external site) Tool page: https://agentarmorhq.com/skills/apache-doris-mcp-server (opens external site)
1 answer
Am I affected? Affected: pip/doris-mcp-server < 0.6.1. Fixed in: 0.6.1.
- Check your version: run
pip show doris-mcp-server. Versions < 0.6.1 of doris-mcp-server are affected.
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "doris-mcp-server>=0.6.1"(first patched version 0.6.1). - Upgrade to Doris version 0.6.1 or later.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-pqrj-4gwg-h5f7 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2025-66336-apache-doris-mcp-server (opens external site) Tool page: https://agentarmorhq.com/skills/apache-doris-mcp-server (opens external site)
Did this work for you?- Check your version: run