Druid

3 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2026-23906 CRITICAL PATCH Act Now

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific prerequisites are met.

Apache Dns Ldap Authentication Bypass Druid

NVD

CVSS 3.1

9.8

EPSS

0.1%

CVE-2025-59390 CRITICAL PATCH Act Now

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Apache Authentication Bypass Druid

NVD

CVSS 3.1

9.8

EPSS

0.1%

CVE-2025-27888 MEDIUM PATCH This Month

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Open Redirect Apache XSS SSRF Druid

NVD

CVSS 4.0

5.8

EPSS

1.0%

CVE-2026-23906

EPSS 0% CVSS 9.8

CRITICAL PATCH Act Now

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific prerequisites are met.

Apache Dns Ldap +2

NVD

CVE-2025-59390

EPSS 0% CVSS 9.8

CRITICAL PATCH Act Now

Apache Authentication Bypass Druid

NVD

CVE-2025-27888

EPSS 1% CVSS 5.8

MEDIUM PATCH This Month

Open Redirect Apache XSS +2

NVD