CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: kafka-bridge, apache-activemq-artemis, logstash, solr, opensearch-fips, apache-activemq, nuxeo, apache-tika, commercial-elasticsearch, elasticsearch, kserve-modelmesh, spark-kubernetes-operator-fips, wavefront-proxy, geoserver, apache-activemq-fips, kafka,...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: kafka-bridge, apache-activemq-artemis, logstash, solr, opensearch-fips, apache-activemq, nuxeo, apache-tika, commercial-elasticsearch, elasticsearch, kserve-modelmesh, spark-kubernetes-operator-fips, wavefront-proxy, geoserver, apache-activemq-fips, kafka,...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: celeborn, kserve-modelmesh, spark, logstash, apache-tika, neo4j, flink, solr, apache-activemq-artemis, druid, opensearch, strimzi-kafka-operator, akhq, wavefront-proxy, infinispan, airflow, apache-pulsar, kafka, sonarqube, zipkin...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: celeborn, kserve-modelmesh, spark, logstash, apache-tika, neo4j, flink, solr, apache-activemq-artemis, druid, opensearch, strimzi-kafka-operator, akhq, wavefront-proxy, infinispan, airflow, apache-pulsar, kafka, sonarqube, zipkin...

GHSA-JR6H-R7VG-F9MC vulnerabilities

Vulnerabilities for packages: druid...

CVE-2022-41404 vulnerabilities

Vulnerabilities for packages: druid...

CLEANSTART-2026-NV78596 Security fixes for CVE-2022-29526, CVE-2025-47907, CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-68121, CVE-2026-24515, CVE-2026-25210, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, ghsa-4f99-4q7p-p3gh applied in versions: 0.10-r0, 0.11-r0, 0.11-r2, 0.11-r3, 0.11-r4

Multiple security vulnerabilities affect the druid-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XH81128 Security fixes for CVE-2022-29526, CVE-2025-47907, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-68121, CVE-2026-24515, CVE-2026-25210, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, ghsa-4f99-4q7p-p3gh applied in versions: 0.10-r0, 0.10-r1, 0.10-r2, 0.10-r3, 0.11-r0

Multiple security vulnerabilities affect the druid-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FN44356 Security fixes for CVE-2022-29526, CVE-2025-47907, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24515, CVE-2026-25210, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 0.10-r0, 0.11-r0, 0.9-r0, 0.9-r1, 0.9-r2

Multiple security vulnerabilities affect the druid-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CL65461 Security fixes for CVE-2022-29526, CVE-2025-47907, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24515, CVE-2026-25210, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 0.10-r0, 0.11-r0, 0.8-r0, 0.8-r1, 0.8-r2, 0.9-r0

Multiple security vulnerabilities affect the druid-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2025-59059 vulnerabilities

Vulnerabilities for packages: trino, druid...

GHSA-C87W-642H-M97H vulnerabilities

Vulnerabilities for packages: trino, druid...

GHSA-C87W-642H-M97H vulnerabilities

Vulnerabilities for packages: druid, trino...

CVE-2025-59059 vulnerabilities

Vulnerabilities for packages: druid, trino...

Apache Druid Authentication Bypass Vulnerability

Apache Druid is the United States Apache Apache Foundation of a use of the Java language , written in column-oriented open source distributed database . Apache Druid has a security vulnerability that originates from improper validation of LDAP authentication responses, which could lead to...

CVE-2026-23906

Affected Products and Versions Apache Druid Affected Versions: 0.17.0 through 35.x all versions prior to 36.0.0 Prerequisites: druid-basic-security extension enabled LDAP authenticator configured Underlying LDAP server permits anonymous bind Vulnerability Description An authentication bypass...

Authentication Bypass

org.apache.druid.extensions:druid-basic-security is vulnerable to an Authentication Bypass. The vulnerability is due to improper validation of LDAP authentication responses when anonymous binds are permitted, which allows an attacker to bypass authentication by supplying an existing username with...

GHSA-Q672-HFC7-G833 Apache Druid Vulnerable to Authentication Bypass

Affected Products and Versions Apache Druid Affected Versions: 0.17.0 through 35.x all versions prior to 36.0.0 Prerequisites: druid-basic-security extension enabled LDAP authenticator configured Underlying LDAP server permits anonymous bind ...

Apache Druid Vulnerable to Authentication Bypass

Affected Products and Versions Apache Druid Affected Versions: 0.17.0 through 35.x all versions prior to 36.0.0 Prerequisites: druid-basic-security extension enabled LDAP authenticator configured Underlying LDAP server permits anonymous bind ...

Missing Authentication

Overview org.apache.druid.extensions:druid-basic-security is a basic security package for Apache Druid. Affected versions of this package are vulnerable to Missing Authentication in validateCredentials for LDAP, which does not check passwords for anonymous bind requests. An attacker in possession...