High severity · published Mar 30, 2021
CVE-2021-26919
Apache Druid allows users to read data from other database systems using JDBC
8.8
CVSS
35.2%
EPSS
No
On KEV
Description
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)35.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Druid · Apache
before 0.20.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26919
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26919
lists.apache.org
https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad%40%3Cdev.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r470f8c92eb5df45f41b3ae609b6315b6c5ff51b3ceb2f09f00ca620f%40%3Cdev.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r6bc68264170046448f823d12c17fd1fd875251d97d60869f58709872%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r7a531ec123570cb7875ff991cf115f99e9ef99a48b3cf3fa4f9d9864%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/ra85fa7d31f9bec1148ffd2e4030934927caa8bff89bca9f61f75e697%40%3Cdev.druid.apache.org%3E
Mailing List
https://lists.apache.org/thread.html/rd87451fce34df54796e66321c40d743a68fb4553d72e7f6f0bc62ebd%40%3Cdev.druid.apache.org%3E
More from Druid
9.8
CVE-2026-23906
Apache Druid: Authentication Bypass via LDAP Anonymous Bind
9.8
CVE-2025-59390
Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
8.8
CVE-2021-25646
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests
6.5
CVE-2024-45537
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
6.5
CVE-2021-36749
In the Druid ingestion system, the InputSource is used for reading data from a certain data source