Skip to content
OpenAdvisories

Package · Maven

org.apache.druid:druid

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-59390 Public exploit

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gr…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • High 8.8
    CVE-2021-25646 Public exploit Scanner template EPSS 99%

    Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

    Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possib…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Medium 6.5
    CVE-2020-1958 Public exploit

    Credentials bypass in Apache Druid

    When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. Th…

    Apache Apache Druid org.apache.druid:druid Maven