CVE-2022-28889: Apache Druid

Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days.

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.

Affected products

• Apache Druid: before 0.23.0 (fixed in 0.23.0)

Published 2022-07-07. Last modified 2026-06-17.