Apache Druid vulnerabilities

12 CVEs affecting Apache Druid, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-23906, published 2026-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-25646, published 2021-01-29. High severity, CVSS 8.8. EPSS: 99% chance of exploitation in the next 30 days. Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by…
CVE-2021-36749, published 2021-09-24. Medium severity, CVSS 6.5. EPSS: 80.9% chance of exploitation in the next 30 days. In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than…
CVE-2021-26919, published 2021-03-30. High severity, CVSS 8.8. EPSS: 35.2% chance of exploitation in the next 30 days. Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks.…
CVE-2021-26920, published 2021-07-02. Medium severity, CVSS 6.5. EPSS: 9.5% chance of exploitation in the next 30 days. In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than…
CVE-2020-1958, published 2020-04-01. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if…
CVE-2021-44791, published 2022-07-07. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
CVE-2022-28889, published 2022-07-07. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
CVE-2025-27888, published 2025-03-20. Medium severity, CVSS 5.4. EPSS: 1.8% chance of exploitation in the next 30 days. Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open…
CVE-2026-23906, published 2026-02-10. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP…
CVE-2024-45384, published 2024-09-17. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through…

Latest

CVE-2025-59390, published 2025-11-26. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is…
CVE-2024-45537, published 2024-09-17. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid…