CVE-2026-23906

Affected Products and Versions Apache Druid Affected Versions: 0.17.0 through 35.x all versions prior to 36.0.0 Prerequisites: druid-basic-security extension enabled LDAP authenticator configured Underlying LDAP server permits anonymous bind ...

CVE-2026-23906

Summary (CVE-2026-23906) : Apache Druid versions 0.17.0 through 35.x are affected when using the druid-basic-security extension with LDAP authentication and an LDAP server that allows anonymous bind. The vulnerability arises from improper validation of LDAP authentication responses, where anonymo...

CVE-2026-23906

creationtimestamp| type| source ---|---|--- 2026-02-09 16:27:41+00:00| seen| https://seclists.org/oss-sec/2026/q1/154 2026-02-09 20:19:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mehbh7zacn26 2026-02-10 16:25:17+00:00| seen|...