IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-04-20 14:16

MODIFIED

2026-04-20 14:16

EPSS (Prob. Exploit)

0.66%

Top 48.4%

DATA SOURCES:

NVD 🔗 2026-04-20 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-05 OSV 🔗 2026-10-25

> DESCRIPTION

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of intended query validation and access restrictions through the MCP query execution interface. Version 0.6.1 and later are not affected.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-89

> CWE DETAILED DESCRIPTIONS

CWE-89: Improper Neutralization of Special Elements used in an SQL Command - The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

> GITHUB SECURITY ADVISORY

GHSA-qhfq-gvvc-5q6q MODERATE

Apache Doris MCP Server vulnerable to SQL Injection via improper query context neutralization

AFFECTED PACKAGES:

PIP / doris-mcp-server

>= 0.1.0, < 0.6.1

Fixed in: 0.6.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Doris MCP Server: MCP SQL inject

AFFECTED PACKAGES:

Unknown / Unknown

3 versions affected

ALIASES:

GHSA-qhfq-gvvc-5q6q, PYSEC-2026-2459

> HISTORIQUE DES MODIFICATIONS

Première apparition

20/04/2026 14:16

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - The product constructs all or part of an SQL command using externally-influenced input from an upstream c...

Nouvelle valeur:

📊 ENRICHISSEMENT 01/05/2026 06:01

CWE