Apache Druid vulnerabilities

• apache druid Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVE-2026-23906 Fix available 9.8 CriticalFebruary 10, 2026
• apache druid Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVE-2025-59390 Public exploitFix available 9.8 CriticalNovember 26, 2025
• apache druid Apache Druid: Server-Side Request Forgery and Cross-Site Scripting CVE-2025-27888 Fix available 5.8 MediumMarch 20, 2025
• apache druid Apache Druid: Users can provide MySQL JDBC properties not on allow list CVE-2024-45537 Fix available 6.5 MediumSeptember 17, 2024
• apache druid Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack CVE-2024-45384 Fix available 5.3 MediumSeptember 17, 2024
• apache druid Clickjacking in the web console CVE-2022-28889 Fix available 4.3 MediumJuly 7, 2022
• apache druid Reflected XSS on certain HTTP endpoints CVE-2021-44791 Fix available 6.1 MediumJuly 7, 2022
• apache druid Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920) CVE-2021-36749 Public exploitFix available EPSS 80.9% 6.5 MediumSeptember 24, 2021
• apache druid Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVE-2021-26920 Fix available 6.5 MediumJuly 2, 2021
• apache druid Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVE-2021-26919 Fix available EPSS 35.2% 8.8 HighMarch 30, 2021
• apache druid Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVE-2021-25646 Public exploitFix available EPSS 99.1% 8.8 HighJanuary 29, 2021
• apache druid Credentials bypass in Apache Druid CVE-2020-1958 Public exploitFix available 6.5 MediumApril 1, 2020