org.apache.druid:druid

8 results · Feed

• Critical 9.8
  CVE-2025-59390 Public exploit

  Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

  Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gr…

  Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  Nov 26, 2025
• Medium 5.8
  CVE-2025-27888 Scanner template

  Apache Druid: Server-Side Request Forgery and Cross-Site Scripting

  Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects …

  Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  Mar 20, 2025
• Medium 6.5
  CVE-2024-45537

  Apache Druid: Users can provide MySQL JDBC properties not on allow list

  Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed pro…

  Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  Sep 17, 2024
• Medium 4.3
  CVE-2022-28889

  Clickjacking in the web console

  In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

  Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  Jul 7, 2022
• Medium 6.1
  CVE-2021-44791

  Reflected XSS on certain HTTP endpoints

  In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

  Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  Jul 7, 2022
• High 8.8
  CVE-2021-26919 EPSS 35%

  Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.

  Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if l…

  Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  Mar 30, 2021
• High 8.8
  CVE-2021-25646 Public exploit Scanner template EPSS 99%

  Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

  Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possib…

  Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  Jan 29, 2021
• Medium 6.5
  CVE-2020-1958 Public exploit

  Credentials bypass in Apache Druid

  When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. Th…

  Apache Apache Druid org.apache.druid:druid Maven
  Apr 1, 2020