Skip to main content

Druid CVE-2026-23906

CRITICAL
Improper Authentication (CWE-287)
2026-02-10 security@apache.org GHSA-q672-hfc7-g833
Authentication Bypass Apache DNS LDAP Druid
9.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to Druid cluster
  2. Delivery
    Send LDAP authentication request
  3. Exploit
    Bind anonymously to LDAP server
  4. Execution
    Bypass authentication check
  5. Impact
    Access Druid resources

Vulnerability Assessment

Weakness
CWE
CWE-287
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK

2 techniques across 2 tactics: Defense Evasion, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

druid-basic-security extension must be enabled with LDAP authenticator configured, and the underlying LDAP server must permit anonymous bind operations.
Impact

CVSS 9.8. Apache Druid instances contain analytics data — bypass exposes query capabilities and data.
Exploit ScenarioDerived

Attacker bypasses Druid authentication to execute analytics queries, accessing sensitive business data.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific prerequisites are met.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:02 CVSS 9.8

Authentication bypass in Apache Druid OLAP database.

RemediationAI

Update to Apache Druid 36.0.0.

Affected Packages

maven org.apache.druid.extensions:druid-basic-security fix: 36.0.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-287 authentication bypass. Druid is a real-time analytics database used for large-scale data analysis.

Know when Druid gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Feb 10, 2026 - 10:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Affected Products and Versions

  • Apache Druid
  • Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0)
  • Prerequisites: * druid-basic-security extension enabled
  • LDAP authenticator configured
  • Underlying LDAP server permits anonymous bind

Vulnerability Description

An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials.

The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication.

Impact

A remote, unauthenticated attacker can:

  • Gain unauthorized access to the Apache Druid cluster
  • Access sensitive data stored in Druid datasources
  • Execute queries and potentially manipulate data
  • Access administrative interfaces if the bypassed account has elevated privileges
  • Completely compromise the confidentiality, integrity, and availability of the Druid deployment

Mitigation

Immediate Mitigation (No Druid Upgrade Required):

  • Disable anonymous bind on your LDAP server. This prevents the vulnerability from being exploitable and is the recommended immediate action.

Resolution

  • Upgrade Apache Druid to version 36.0.0 or later, which includes fixes to properly reject anonymous LDAP bind attempts.

Executive ViewAI

Why It Matters

Apache Druid deployments using LDAP authentication are vulnerable to complete authentication bypass, allowing unauthorized access to sensitive data and analytics infrastructure. Organizations running affected versions (0.17.0-35.x) with basic security and LDAP enabled face immediate risk of unauthorized data access, system compromise, and potential regulatory violations.

Business Impact: Severe
Compensating Controls

Disable the druid-basic-security extension and LDAP authenticator if operationally feasible; implement network-level access controls and WAF rules to restrict Druid API endpoints to trusted IP ranges only; deploy reverse proxy authentication layer in front of Druid; enable VPN requirement for all Druid access; configure LDAP server to deny anonymous bind if not already restricted; increase monitoring and alerting on authentication failures and unusual data access patterns; consider temporary shutdown of affected Druid clusters until patch availability is confirmed.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*

More in Druid

View all
CVE-2021-25646 HIGH POC
8.8 Jan 29

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. Rated

CVE-2021-36749 MEDIUM POC
6.5 Sep 24

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. Rated medium severit
CVE-2025-27888 MEDIUM POC
5.8 Mar 20

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page

CVE-2025-59390 CRITICAL
9.8 Nov 26

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSign
CVE-2021-26919 HIGH
8.8 Mar 30

Apache Druid allows users to read data from other database systems using JDBC. Rated high severity (CVSS 8.8), this vuln
CVE-2021-33800 HIGH
7.5 Nov 03

In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. Rated high sever
CVE-2024-45537 MEDIUM
6.5 Sep 17

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. Rated medium sev
CVE-2021-26920 MEDIUM
6.5 Jul 02

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. Rated medium severit
CVE-2020-1958 MEDIUM
6.5 Apr 01

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials c
CVE-2024-45384 MEDIUM
5.3 Sep 17

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. Rated medium severity (CVSS 5.3), this vulnerabilit
CVE-2022-28889 MEDIUM
4.3 Jul 07

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Rated medium sev

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://lists.apache.org/thread/2x9rv3kv6t1p577lvq4z0rl0zlt9g4sr REF http://www.openwall.com/lists/oss-security/2026/02/09/5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy