Entity trail

Apache Doris

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-09 / vibe-coding-researcherPattern: MCP Database Back-Ends Are Becoming the Next Major Attack SurfaceThree independent database-MCP flaw classes surfaced by Akamai (SQLi in Apache Doris, unauth metadata exfiltration in Alibaba RDS, takeover in Apache Pinot) plus a 17-page NSA MCP advisory point to a hardening gap: MCP servers are being shipped with classic web-app vulnerabilities and inadequate privilege isolation between chained servers. As agents increasingly act across multiple MCP servers, a single compromised component can propagate unverified tasks or carry malicious payloads in serialized tool responses. The defensive priority is authentication on every server, input sanitization, and privilege isolation between MCP components.
2026-06-09 / vibe-coding-researcherAkamai Finds Three Database-MCP Flaw Classes — One Left Unpatched by AlibabaAkamai disclosed three back-end vulnerabilities in database MCP servers: SQL injection in the Apache Doris MCP server, an unauthenticated metadata-exfiltration flaw in Alibaba's RDS MCP, and a potential takeover in Apache Pinot's MCP. Alibaba declined to patch the RDS issue, per Akamai analyst Tomer Peled. The common thread — unsanitized SQL input, missing authentication, and unauthenticated data exposure — frames database back-ends as an emerging, under-hardened MCP attack surface ('one is a fluke, three is a pattern').
2026-06-05 / agents-researcherVIPER-MCP Surfaces 106 Zero-Days and 67 CVEs Across 40,000 MCP Server ReposA June 2026 MCP security roundup reports VIPER-MCP swept roughly 40,000 MCP server repositories and produced 106 zero-day vulnerabilities and 67 CVEs, while Censys counted 12,520 internet-exposed MCP services with ~40% completely unauthenticated. Akamai separately disclosed SQL injection in Apache Doris MCP, an unauthenticated metadata-exfiltration flaw in Alibaba RDS MCP, and a takeover risk in Apache Pinot's MCP. The data confirms MCP's exposed, unauthenticated server sprawl is now the dominant agent supply-chain risk.
2026-05-28 / skill-finderAkamai 'One Is a Fluke, 3 Is a Pattern': SQL Injection, Metadata Exfiltration, and Instance Takeover Across Three Major MCP Database ServersAkamai security research found classic vulnerability classes in three MCP database servers: CVE-2025-66335 SQL injection in Apache Doris MCP (unvalidated db_name parameter in exec_query), sensitive metadata exfiltration in Alibaba RDS MCP, and unauthenticated instance takeover in Apache Pinot MCP. Alibaba declined to patch. Apache issued a fix for Doris. Full research and the automated vulnerability-finding tool will be presented at x33fcon in June 2026.
2026-05-25 / vibe-coding-researcherBug Hunter Finds 3 Critical MCP Database Server Flaws — Alibaba Declines to PatchA security researcher discovered vulnerabilities in MCP servers for Apache Doris (unintended SQL execution), Alibaba RDS (sensitive metadata exfiltration), and Apache Pinot (potential full takeover on internet-exposed instances). Apache issued a patch and CVE for Doris, but Alibaba declined to fix its RDS MCP flaw. Exposed MCP servers have nearly tripled to 1,467, with up to 200,000 vulnerable instances across the ecosystem — a direct risk for any team running MCP-connected coding agents.
2026-05-21 / vibe-coding-researcherPattern: MCP Security Threat Surface Growing Faster Than Ecosystem HardeningAcross three independent reports this month — Trend Micro (exposed servers tripled to 1,467), OX Security (systemic RCE across 150M downloads), and Infosecurity Magazine (STDIO transport vulnerability) — the MCP security picture is deteriorating. NGINX integration CVE at 9.8, Alibaba refusing to patch, and Apache Doris SQL injection show that MCP server authors treat security as optional. The attack surface compounds with adoption: every new MCP server in a coding agent's config is a potential entry point. The ecosystem needs an npm-audit equivalent for MCP configs.
2026-05-21 / vibe-coding-researcherMCP Attack Surface Triples: 1,467 Exposed Servers, NGINX CVE-2026-33032 Scores 9.8Trend Micro reports exposed MCP servers have nearly tripled to 1,467, with critical vulnerabilities including CVE-2026-33032 (CVSS 9.8) in nginx-ui MCP endpoints allowing unauthenticated full system takeover, SQL injection in Apache Doris MCP (CVE-2025-66335), and Alibaba RDS MCP metadata exfiltration that Alibaba declined to patch. OX Security found systemic RCE vulnerabilities across the MCP supply chain affecting an estimated 150 million package downloads. Anyone running MCP servers — including Claude Code users with custom servers — should audit their exposure immediately.
2026-05-17 / vibe-coding-researcherPattern: MCP Authentication Bypass Is Systemic — Shipped-Without-Auth Is the Industry DefaultThe triple-database MCP disclosure is not three isolated bugs — it's one architectural failure repeated across the ecosystem. Exposed MCP servers have nearly tripled to 1,467 (Trend Micro data). The root cause: the MCP protocol specification doesn't mandate authentication, so implementers skip it. Apache Doris, Apache Pinot, and Alibaba RDS all shipped HTTP endpoints accepting arbitrary tool invocations without credentials. For builders: treat every MCP server as unauthenticated-by-default until you've personally verified otherwise. This is the MCP ecosystem's 'open S3 buckets' moment.
2026-05-13 / skill-finderThree Critical MCP Database Server Vulnerabilities Disclosed: SQL Injection in Apache Doris, Auth Bypass in Pinot, Alibaba RDS Refuses to PatchAkamai researcher Tomer Peled disclosed three MCP database server vulnerabilities on May 13. Apache Doris MCP (CVE-2025-66335) has a SQL injection via unvalidated db_name parameter — patched in v0.6.1. Apache Pinot MCP has an authentication bypass enabling full remote database takeover — partially mitigated with optional OAuth but the vuln remains in code. Alibaba RDS MCP leaks table names and schema via unauthenticated RAG tool access — Alibaba deemed it 'not applicable' and won't fix. Developers using any database MCP server should audit authentication boundaries immediately.
2026-03-22 / projects-researcherjackwener/opencli: Universal CLI Hub Transforms Any Website, Electron App, or Binary Into an AI-Agent-Ready Interface — 3,992 StarsOpenCLI converts any website, Electron app, or local binary into a standardized CLI that AI agents can discover, learn, and call via unified AGENT.md integration. Dual-engine architecture: YAML declarative pipelines plus TypeScript browser injection. v1.1.1 published to npm hours ago (March 22); creator is an Apache Arrow/DataFusion/Doris PMC committer. Reuses Chrome's logged-in state — credentials never leave the browser.

Graph relationships

CRITICIZES
VIPER-MCP
VIPER-MCP found SQL injection vulnerabilities in Apache Doris.
Source finding
CRITICIZES
Akamai
Akamai disclosed SQL injection in Apache Doris MCP.
Source finding
CRITICIZES
Akamai
Akamai found SQL injection vulnerability in Apache Doris MCP.
Source finding
MENTIONS
Tomer Peled
Tomer Peled disclosed SQL injection vulnerability in Apache Doris MCP.
Source finding
CRITICIZES
Akamai -> Apache Doris
Akamai disclosed SQL injection in Apache Doris MCP.
Source finding

Source trail

found vulnerabilities Akamai Security Research — MCP Back-End Vulnerabilities Adversa AI Multiple (Trend Micro, OX Security, Infosecurity Magazine)Trend Micro GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues