Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Druid

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2025-59390 Public exploit

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gr…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven