An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions.
Impact:
Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.
Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).
Impact:
Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.
Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 05 Nov 2025 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 05 Nov 2025 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications. Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix). | |
| Title | Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server | |
| Weaknesses | CWE-284 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2025-11-05T10:06:00.686Z
Reserved: 2025-08-29T01:50:06.048Z
Link: CVE-2025-58337
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-05T10:15:36.483
Modified: 2025-11-05T11:15:35.070
Link: CVE-2025-58337
Redhat
No data.
OpenCVE Enrichment
No data.