CVE-2026-23906

Affected Products and Versions Apache Druid Affected Versions: 0.17.0 through 35.x all versions prior to 36.0.0 Prerequisites: druid-basic-security extension enabled LDAP authenticator configured Underlying LDAP server permits anonymous bind ...

CVE-2026-23906

Apache Druid versions 0.17.0 through 35.x are vulnerable to an authentication bypass when the druid-basic-security extension is enabled with an LDAP authenticator . If the underlying LDAP server permits anonymous binds , the system improperly validates the response, allowing an attacker to bypass...

CVE-2026-23906

creationtimestamp| type| source ---|---|--- 2026-02-09 16:27:41+00:00| seen| https://seclists.org/oss-sec/2026/q1/154 2026-02-09 20:19:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mehbh7zacn26 2026-02-10 16:25:17+00:00| seen|...