org.apache.druid:druid vulnerabilities (Maven)

8 vulnerabilities.

• org.apache.druid:druid Maven Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVE-2025-59390 Public exploitFix available 9.8 CriticalNovember 26, 2025
• org.apache.druid:druid Maven Apache Druid: Server-Side Request Forgery and Cross-Site Scripting CVE-2025-27888 Fix available 5.8 MediumMarch 20, 2025
• org.apache.druid:druid Maven Apache Druid: Users can provide MySQL JDBC properties not on allow list CVE-2024-45537 Fix available 6.5 MediumSeptember 17, 2024
• org.apache.druid:druid Maven Clickjacking in the web console CVE-2022-28889 Fix available 4.3 MediumJuly 7, 2022
• org.apache.druid:druid Maven Reflected XSS on certain HTTP endpoints CVE-2021-44791 Fix available 6.1 MediumJuly 7, 2022
• org.apache.druid:druid Maven Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVE-2021-26919 Fix available EPSS 35.2% 8.8 HighMarch 30, 2021
• org.apache.druid:druid Maven Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVE-2021-25646 Public exploitFix available EPSS 99.1% 8.8 HighJanuary 29, 2021
• org.apache.druid:druid Maven Credentials bypass in Apache Druid CVE-2020-1958 Public exploitFix available 6.5 MediumApril 1, 2020