Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode

中 5.4CVE-2025-58337 · GHSA-m35w-xx8c-6xc7 · PYSEC-2026-1315 · 05/11/2025 公開 · 18/10/2026 更新

要点

CVE-2025-58337 は doris-mcp-server, doris mcp server (apache) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.37%（全脆弱性の 31.3% より高い）。
対処：0.6.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
doris-mcp-server PyPI	`< 0.6.0`	`0.6.0`
doris mcp server apache	`< 0.6.0`	`0.6.0`

概要

Impact:

Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.

Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).

NVD の説明

An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications. Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).