CVE-2025-58337: 
Python vulnerability analysis and mitigation

CVE-2025-58337 affects Apache Doris-MCP-Server versions 0.1.0 to versions before 0.6.0, discovered and disclosed on November 4, 2025. The vulnerability involves improper access control in the Doris MCP Server that allows bypassing read-only mode restrictions. This security issue was identified by Liran Tal (OSS Security, Apache Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) with a CVSS 3.1 Base Score of 5.4 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The EPSS score is reported as 0.02949%. The vulnerability exists in the access control mechanism of the Doris MCP Server, specifically affecting the read-only mode implementation (Miggo Database, NVD).

The vulnerability allows attackers with valid read-only accounts to perform unauthorized modifications that should be restricted by read-only mode. This bypasses the intended security controls and could lead to unauthorized data modifications in the system (OSS Security).

The recommended mitigation is to upgrade to Doris MCP Server version 0.6.0, which contains the fix for this vulnerability. This upgrade should be performed as soon as possible to prevent potential exploitation (OSS Security).