{"action":"Upgrade doris-mcp-server to 0.6.0 or later.","affected":[{"fixed":"0.6.0","introduced":"0"}],"component":"doris-mcp-server","cve_ids":["CVE-2025-58337"],"ecosystem":"PyPI","epss":0.00372,"exploited":false,"fixed_versions":["0.6.0"],"ghsa_id":"GHSA-m35w-xx8c-6xc7","id":"tcs_01M5KGRVSNBRJACDKPAE4RCE89","modified_at":"2026-07-07T17:46:39.509922604Z","published_at":"2026-07-07T16:03:09.628957Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1315","https://nvd.nist.gov/vuln/detail/CVE-2025-58337","https://github.com/apache/doris-mcp-server/commit/5923cc1c8973069a6d54eca1948a10488cbf409e","https://github.com/apache/doris-mcp-server","https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h","https://security.snyk.io/vuln/SNYK-PYTHON-DORISMCPSERVER-13835132","http://www.openwall.com/lists/oss-security/2025/11/04/5","https://pypi.org/project/doris-mcp-server","https://github.com/advisories/GHSA-m35w-xx8c-6xc7"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1315","url":"https://osv.dev/vulnerability/PYSEC-2026-1315"},{"source":"nvd","source_id":"CVE-2025-58337","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58337"}],"summary":"Apache Doris-MCP-Server: Improper Access Control results in bypassing a \"read-only\" mode"}