CVE-2025-58337
CVE-2025-58337 · Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications. Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).
CVSS 5.4 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
apache doris-mcp-server
- Versions
- ≥ 0.1.0, < 0.6.0: Affected (semver)
Update to 0.6.0
doris-mcp-server PyPI
- Versions
- 0.4.2
- 0.5.0
- 0.5.1
- Affected ranges
- ECOSYSTEM: < 0.6.0
Update to 0.6.0