{
  "entry": {
    "kind": "vuln",
    "slug": "three-mcp-database-server-flaws-hit-apache-doris-alibaba-rds-apache",
    "name": "three-mcp-database-server-flaws-hit-apache-doris-alibaba-rds-apache",
    "vendor": "Apache Doris MCP server",
    "description": "A bug hunter disclosed three MCP server flaws across major database integrations: Apache Doris's MCP server allowed unintended SQL execution via prompt injection; Alibaba RDS's MCP server leaked sensitive metadata and connection-string fragments; Apache Pinot's MCP server enabled potential instance takeover for internet-exposed deployments. Apache patched its two; Alibaba declined to patch and recommended customers disable the MCP bridge entirely. Affects any AI agent that connected through these MCP servers.",
    "website": "https://www.theregister.com/security/2026/05/13/bug-hunter-tracks-down-three-serious-mcp-database-flaws-one-left-unpatched/5238916",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-05-14",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "three-mcp-database-server-flaws-hit-apache-doris-alibaba-rds-apache",
      "aliases": [
        "ti-025"
      ],
      "title": "Three MCP Database-Server Flaws Hit Apache Doris, Alibaba RDS, Apache Pinot: One Left Unpatched",
      "summary": "A bug hunter disclosed three MCP server flaws across major database integrations: Apache Doris's MCP server allowed unintended SQL execution via prompt injection; Alibaba RDS's MCP server leaked sensitive metadata and connection-string fragments; Apache Pinot's MCP server enabled potential instance takeover for internet-exposed deployments. Apache patched its two; Alibaba declined to patch and recommended customers disable the MCP bridge entirely. Affects any AI agent that connected through these MCP servers.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Information disclosure"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Apache Doris MCP server",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Apache Doris MCP server (patched), Apache Pinot MCP server (patched), Alibaba RDS MCP server (UNPATCHED)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-05-14",
      "modifiedAt": "2026-05-14",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.theregister.com/security/2026/05/13/bug-hunter-tracks-down-three-serious-mcp-database-flaws-one-left-unpatched/5238916"
        }
      ],
      "mitigation": "Update Apache Doris and Pinot MCP servers to latest. Disable the Alibaba RDS MCP server until vendor ships a fix. Audit database query logs for prompt-injection-style SQL since April. Restrict MCP database servers to least-privilege DB roles.",
      "detectedByAnomity": true
    }
  }
}