Apache Software Foundation Apache Druid
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-23906 | 0.17.0 – < 36.0.0 | Apache Druid: Authentication Bypass via LDAP Anonymous Bind | CRITICAL 9.8 | 1.1 % | ||
| CVE-2025-59390 | ≤ 34.0.0 | Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. | CRITICAL 9.8 | 0.7 % | ||
| CVE-2025-27888 | < 31.0.2 ; 32.0.0 | Apache Druid: Server-Side Request Forgery and Cross-Site Scripting | MEDIUM 5.8 | 1.8 % | ||
| CVE-2024-45537 | ≤ 30.0.0 | Apache Druid: Users can provide MySQL JDBC properties not on allow list | MEDIUM 6.5 | 0.6 % | ||
| CVE-2024-45384 | 0.18.0 – 30.0.0 | Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack | MEDIUM 5.3 | 0.8 % | ||
| CVE-2022-28889 | unspecified – 0.22.1 | Clickjacking in the web console | MEDIUM 4.3 | 1.9 % | ||
| CVE-2021-44791 | Apache Druid – 0.22.1 | Reflected XSS on certain HTTP endpoints | MEDIUM 6.1 | 2.2 % | ||
| CVE-2021-36749 | 0.21.1 and earlier – 0.21.1 | Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-2… | MEDIUM 6.5 | 81 % | ||
| CVE-2021-26920 | Apache Druid – 0.20.2 | Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended | MEDIUM 6.5 | 9.5 % | ||
| CVE-2021-26919 | Apache Druid – 0.20.1 | Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. | HIGH 8.8 | 35 % | ||
| CVE-2021-25646 | 0.20.0 and earlier – 0.20.0 | Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. | HIGH 8.8 | 99 % |