Apache Doris MCP Server contains an improper neutralization flaw in its query context handling that allows an attacker to inject SQL statements through the MCP query execution interface. The injected commands bypass the intended validation logic and can execute unintended queries, potentially enabling data exfiltration, unauthorized modification, or denial of service. This vulnerability is a classic example of CWE‑89, where failure to properly sanitize user input leads to SQL injection.

Apache Doris MCP Server, distributed by the Apache Software Foundation, is affected in all releases older than version 0.6.1. Versions 0.6.1 and newer do not contain this flaw. The vulnerability does not specify sub‑components or modules beyond the general MCP query interface, so any deployment of the affected server should be considered at risk.

The CVE metadata lists a CVSS score of 5.3 and an EPSS score that is not available, indicating a moderate severity vulnerability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote over the network via the MCP query endpoint, which is typically accessible to external actors. Because the flaw resides in core query handling and no workaround is publicly documented, exploitation could be straightforward for an attacker with network access to the server. Monitoring for anomalous query activity and limiting exposure until a patch is applied remain prudent measures.