Login Request a demo
DR
Product
Druid
by Apache · last CVE Feb 10, 2026
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 2High 2Medium 8Low 0
Severity
All severities12Critical2High2Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Druid to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-23906
9.8
1%
Feb 10
Apache Druid: Authentication Bypass via LDAP Anonymous Bind
Affected: 0.17.0 before 36.0.0
CVE-2025-59390
9.8
1%
Nov 26
Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
Affected: before 35.0.0
CVE-2021-26919
8.8
35%
Mar 30
Apache Druid allows users to read data from other database systems using JDBC
Affected: before 0.20.2
CVE-2021-25646
8.8
99%
Jan 29
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests
Affected: through 0.20.0
CVE-2024-45537
6.5
1%
Sep 17
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
Affected: before 30.0.1
CVE-2021-36749
6.5
81%
Sep 24
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
Affected: before 0.22.0
CVE-2021-26920
6.5
9%
Jul 2
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
Affected: before 0.22.0
CVE-2020-1958
6.5
5%
Apr 1
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter…
Affected: 0.17.0
CVE-2021-44791
6.1
2%
Jul 7
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses
Affected: through 0.22.1
CVE-2025-27888
5.4
2%
Mar 20
Apache Druid: Server-Side Request Forgery and Cross-Site Scripting
Affected: before 31.0.2
CVE-2024-45384
5.3
1%
Sep 17
Padding Oracle vulnerability in Apache Druid extension, druid-pac4j
Affected: 0.18.0 before 30.0.1
CVE-2022-28889
4.3
2%
Jul 7
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking
Affected: before 0.23.0
Showing 12