Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Druid

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-59390 Public exploit

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gr…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Medium 6.5
    CVE-2021-36749 Public exploit EPSS 81%

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…

    Apache Software Foundation Apache Druid org.apache.druid:druid-core Maven
  • High 8.8
    CVE-2021-25646 Public exploit EPSS 99%

    Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

    Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possib…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven