Apache Druid - Local File Inclusion

Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t...

CVE-2022-41404 vulnerabilities

Vulnerabilities for packages: druid...

GHSA-GRG4-WF29-R9VV vulnerabilities

Vulnerabilities for packages: druid...

CVE-2021-37137 vulnerabilities

Vulnerabilities for packages: druid...

CVE-2021-37136 vulnerabilities

Vulnerabilities for packages: druid...

GHSA-9VJP-V76F-G363 vulnerabilities

Vulnerabilities for packages: druid...

GHSA-JR6H-R7VG-F9MC vulnerabilities

Vulnerabilities for packages: druid...

GHSA-8C42-7QJ2-3J46 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, thingsboard, opensearch, trino, apicurio-registry, druid, wildfly, tez, infinispan, management-api-for-apache-cassandra-5.0, apache-pulsar, zipkin, akhq, keycloak, wavefront-proxy, neo4j...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, thingsboard, opensearch, trino, apicurio-registry, druid, wildfly, tez, infinispan, management-api-for-apache-cassandra-5.0, apache-pulsar, zipkin, akhq, keycloak, wavefront-proxy, neo4j...

CVE-2026-54428 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, thingsboard, opensearch, cassandra-reaper, apicurio-registry, druid, nrjmx, akhq...

GHSA-V3JC-474W-2WM6 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, thingsboard, opensearch, cassandra-reaper, apicurio-registry, druid, nrjmx, akhq...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: celeborn, thingsboard, opensearch, apicurio-registry, druid, spark, tez, management-api-for-apache-cassandra-5.0, strimzi-kafka-operator, apache-pulsar, zipkin, akhq, keycloak, apache-nifi...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: py3-azure-identity, step, falcoctl, hugo, flyte, flux-kustomize-controller, py3-cassandra-medusa, rook, ksops, rclone, sops, trivy, step-ca, thanos, nuclei, up, zarf, sqlpad, hugo-extended, spire-server, chezmoi, flux-image-reflector-controller, guac,...

Apache Druid - Remote Code Execution

Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. id: CVE-2021-25646 info: name: Apache Druid - Remote Cod...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: thingsboard, opensearch, cassandra-reaper, apicurio-registry, druid, nrjmx, akhq...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: thingsboard, opensearch, cassandra-reaper, apicurio-registry, druid, nrjmx, akhq...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

Malicious code in @or-sdk/druid (npm)

npm/@or-sdk/druid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

MAL-2026-11690 Malicious code in @or-sdk/druid (npm)

npm/@or-sdk/druid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

CLEANSTART-2026-QA27412 Security fixes in druid-exporter-fips 0.10-r4

Package druid-exporter-fips version 0.10-r4 fixes 8 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32283...