Apache Software Foundation Apache Druid vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Latest Apache Software Foundation Apache Druid vulnerabilities

CVE-2026-23906 — Apache Druid: Authentication Bypass via LDAP Anonymous Bind (CVSS 9.8)
CVE-2025-59390 — Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. (CVSS 9.8)
CVE-2025-27888 — Apache Druid: Server-Side Request Forgery and Cross-Site Scripting (CVSS 5.4)
CVE-2024-45537 — Apache Druid: Users can provide MySQL JDBC properties not on allow list (CVSS 6.5)
CVE-2024-45384 — Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack (CVSS 5.3)
CVE-2022-28889 — Clickjacking in the web console (CVSS 4.3)
CVE-2021-44791 — Reflected XSS on certain HTTP endpoints (CVSS 6.1)
CVE-2021-36749 — Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920) (CVSS 6.5)
CVE-2021-26920 — Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (CVSS 6.5)
CVE-2021-26919 — Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. (CVSS 8.8)
CVE-2021-25646 — Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. (CVSS 8.8)
CVE-2020-1958 — (CVSS 6.5)