CVE-2020-1958

Credentials bypass in Apache Druid

6.5 MediumPublic exploitFix available

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

4.57%Down 15.8 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

Record: CVE-2020-1958
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness: CWE-74
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-1958
Updated: 2026-11-02

EUVDEUVD-2022-1152 No score

Record: EUVD-2022-1152
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qh2g-7h5p-mxf4 6.5

Credentials bypass in Apache Druid

Record: GHSA-qh2g-7h5p-mxf4
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-74, CWE-200
Updated: 2026-11-02

OSV 6.5

Record: CVE-2020-1958
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-qh2g-7h5p-mxf4 6.5

Credentials bypass in Apache Druid

Record: GHSA-qh2g-7h5p-mxf4
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-74
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.druid:druid` Maven	0.17.0 to 0.17.0	0.17.1
`org.apache.druid:druid` Maven	0.17.0 up to 0.17.1	0.17.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	ggolawski/CVE-2020-1958	2020-04-11

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-1958 is a medium vulnerability (CVSS 6.5) in Apache Druid, published April 1, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.57%, the 91st percentile. Fixed in org.apache.druid:druid 0.17.1.

References

Show 13 moreShow less