Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Druid

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.8
    CVE-2025-27888

    Apache Druid: Server-Side Request Forgery and Cross-Site Scripting

    Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects …

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Medium 6.5
    CVE-2024-45537

    Apache Druid: Users can provide MySQL JDBC properties not on allow list

    Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed pro…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Medium 5.3
    CVE-2024-45384

    Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack

    Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by…

    Apache Software Foundation Apache Druid org.apache.druid.extensions:druid-pac4j Maven
  • Medium 4.3
    CVE-2022-28889

    Clickjacking in the web console

    In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Medium 6.1
    CVE-2021-44791

    Reflected XSS on certain HTTP endpoints

    In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Medium 6.5
    CVE-2021-36749 Public exploit EPSS 81%

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…

    Apache Software Foundation Apache Druid org.apache.druid:druid-core Maven
  • Medium 6.5
    CVE-2021-26920

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…

    Apache Software Foundation Apache Druid fast-xml-parser org.apache.druid:druid-core npm Maven