gitsafehub
github.com/apache/doris-mcp-server ↗

apache/doris-mcp-server

scanned 2026-08-08 · git c0a8ce4
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets8Vulnerable dependencies15Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies6Project health—

Security checks

Leaked secrets — Gitleaksⓘ 8 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_http_bind_auth_policy.py:37
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_effective_auth_config.py:12
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_security_manager.py:32
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_static_token_bootstrap.py:35
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_static_token_bootstrap.py:36
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_token_management_auth.py:30
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_token_digest_storage.py:38
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/security/test_token_digest_storage.py:199
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 15 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2026-27962 authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability
    uv.lock
    A package you depend on has a known security hole (CVE-2026-27962). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-59420 authlib: Authlib RFC violation
    uv.lock
    A package you depend on has a known security hole (CVE-2025-59420). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-61920 authlib: Authlib Denial of Service
    uv.lock
    A package you depend on has a known security hole (CVE-2025-61920). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-28490 authlib: Authlib: Information disclosure due to cryptographic padding oracle in JWE RSA1_5
    uv.lock
    A package you depend on has a known security hole (CVE-2026-28490). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-28498 authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens
    uv.lock
    A package you depend on has a known security hole (CVE-2026-28498). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-62706 authlib: Authlib : JWE zip=DEF decompression bomb enables DoS
    uv.lock
    A package you depend on has a known security hole (CVE-2025-62706). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-68158 Authlib: Authlib: Cross-Site Request Forgery due to improper session management in state storage
    uv.lock
    A package you depend on has a known security hole (CVE-2025-68158). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41425 authlib: Authlib: Cross-Site Request Forgery (CSRF) vulnerability in OAuth cache feature
    uv.lock
    A package you depend on has a known security hole (CVE-2026-41425). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41479 Authlib is a Python library which builds OAuth and OpenID Connect serv ...
    uv.lock
    A package you depend on has a known security hole (CVE-2026-41479). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44681 Authlib is a Python library which builds OAuth and OpenID Connect serv ...
    uv.lock
    A package you depend on has a known security hole (CVE-2026-44681). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-32274 black: Black: Arbitrary file writes from unsanitized user input in cache file name
    uv.lock
    A package you depend on has a known security hole (CVE-2026-32274). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-68480 github.com/marshmallow-code/marshmallow: Marshmallow: Denial of Service via crafted request to Schema.load function
    uv.lock
    A package you depend on has a known security hole (CVE-2025-68480). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling
    uv.lock
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59890 setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)
    uv.lock
    A package you depend on has a known security hole (CVE-2026-59890). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22702 virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition
    uv.lock
    A package you depend on has a known security hole (CVE-2026-22702). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 400s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ 6 found · 2 serious

Packages that look intentionally malicious: typosquats, sneaky install scripts.

  • Serious guarddog-pypi-code-execution code-execution match in pyarrow 25.0.0
    pyarrow
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
  • Serious guarddog-pypi-code-execution code-execution match in pandas 3.0.5
    pandas
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
  • Worth fixing guarddog-pypi-obfuscation obfuscation match in passlib 1.7.4
    passlib
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
  • Worth fixing guarddog-pypi-shady-links shady-links match in tqdm 4.70.0
    tqdm
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
  • Worth fixing guarddog-pypi-clipboard-access clipboard-access match in pandas 3.0.5
    pandas
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
  • Worth fixing guarddog-pypi-shady-links shady-links match in Pygments 2.20.0
    Pygments
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.