Apache Doris MCP Server contains a SQL injection flaw in a metadata query path; an attacker can supply a user‑controlled database name that is interpolated directly into a SQL statement executed without honoring the caller’s authorization context. This bug allows an authenticated attacker, or an anonymous user when authentication is disabled, to bypass the server’s SQL security checks and read metadata from databases outside the intended scope. The weakness corresponds to the classic input‑validation failure described by CWE‑89.

The vulnerability affects Apache Doris MCP Server from the Apache Software Foundation. All releases prior to version 0.6.1 are impacted; users should upgrade to 0.6.1 or later.

The flaw permits an attacker who can reach the MCP Server’s metadata query endpoint to inject a database name that causes the server to execute a SQL statement in a context lacking proper authorization checks. The attack is likely remote, using HTTP or REST calls, and does not require privilege escalation beyond legitimate authentication. If authentication is disabled, even anonymous users can exploit the injection. The effect is unauthorized read of metadata from other databases, constituting a data‑disclosure and privilege‑elevation risk for the affected system. The EPSS score is not available and the vulnerability is not listed in CISA KEV.