Apache Software Foundation Apache Druid

• CVE-2026-23906 Critical 9.8 Apache Druid: Authentication Bypass via LDAP Anonymous Bind 1.1%
• CVE-2025-59390 Critical 9.8 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. 0.7%
• CVE-2025-27888 Medium 5.8 Apache Druid: Server-Side Request Forgery and Cross-Site Scripting 1.8%
• CVE-2024-45537 Medium 6.5 Apache Druid: Users can provide MySQL JDBC properties not on allow list 0.6%
• CVE-2024-45384 Medium 5.3 Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack 0.8%
• CVE-2022-28889 Unrated Clickjacking in the web console 1.9%
• CVE-2021-44791 Unrated Reflected XSS on certain HTTP endpoints 2.3%
• CVE-2021-36749 Unrated Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920) 80.9%
• CVE-2021-26920 Unrated Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended 9.5%
• CVE-2021-26919 Unrated Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. 35.2%
• CVE-2021-25646 Unrated Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. 99.1%