CVE-2021-26919

CVE-2021-26919 affects Apache Druid, where allowing users with certain JDBC permissions to supply MySQL JDBC properties not on the allowed list could enable code execution in Druid server processes via a malicious MySQL server. Documented behavior: trusted users can set up lookups or ingestion ta...

CVE-2021-36749

In Apache Druid versions

CVE-2021-26920

The Apache Druid ingestion system contains a vulnerability in the HTTP InputSource component. Authenticated users can exploit this flaw to read data from unintended sources, such as the local file system , using the privileges of the Druid server process. While direct access to Druid provides a L...

CVE-2025-27888

Affected software and issue: Apache Druid with the management proxy enabled is vulnerable to SSRF, XSS, and Open Redirect via specially crafted URLs. Root cause / vulnerability details: When a request is proxied through the Druid management proxy, a crafted URL can redirect to an arbitrary server...

CVE-2022-28889

CVE-2022-28889 affects Apache Druid up to v0.22.1: the web console/server did not send headers to mitigate clickjacking. Druid v0.23.0 and later address this by implementing a Content-Security-Policy header. Base CVSSv3.1 score 4.3 (MEDIUM). The connected sources confirm impact is limited to miss...

CVE-2024-45537

Apache Druid CVE-2024-45537 describes a vulnerability where an authenticated user can bypass authorization by sending a specially crafted MySQL JDBC connection string that includes properties not on the allow list, enabling access to read data from other databases via JDBC. The issue stems from i...

CVE-2025-59390

Apache Druid (versions through 34.0.0 ) is vulnerable to a Weak Authentication flaw in its Kerberos authenticator. When the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set, the system uses a weak fallback secret generated by ThreadLocalRandom, which is ...