Cherno.X

**Name of the Vulnerable Software and Affected Versions** Apache Doris MCP Server versions prior to 0.6.1 **Description** A SQL injection exists in a metadata query path where a user-controlled database name is directly interpolated into a SQL query. The query is executed without the caller's authorization context, allowing an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope. **Recommendations** Upgrade to version 0.6.1 or later.