Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Druid

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-23906

    Apache Druid: Authentication Bypass via LDAP Anonymous Bind

    Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind    …

    Apache Software Foundation Apache Druid org.apache.druid.extensions:druid-basic-security Maven
  • Critical 9.8
    CVE-2025-59390 Public exploit

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gr…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven