CVE-2025-58337 Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode
Attackers with read-only access can bypass restrictions to perform unauthorized data modifications in Apache Doris MCP Server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58337?
CVE-2025-58337 is a medium-severity missing authorization vulnerability in Apache Doris-MCP-Server, published on 5 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions.
Impact:
Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.
Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).
Weakness: CWE-284
Which versions are affected by CVE-2025-58337?
3 open source packages ship an affected version, including doris-mcp-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
doris-mcp-server PyPI | All versions | 0.6.0 |
doris-mcp-server PyPI | All versions | 0.6.0 |
doris-mcp-server PyPI | All versions | 0.6.0 |
Products include Apache Doris Mcp Server.
How do I fix CVE-2025-58337?
Upgrade doris-mcp-server to 0.6.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-58337 being exploited?
There is no known exploitation of CVE-2025-58337 in the wild and no public exploit code.
Other vulnerabilities in Apache Doris-MCP-Server
Sources
Also known as GHSA-m35w-xx8c-6xc7, PYSEC-2026-1315.