Druid vulnerabilities

2 known vulnerabilities in Druid from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Apache Druid: Improper Authentication

  CVE-2026-23906Feb 10, 2026ApacheEPSS 1.07%

  Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind Vuln

• 9.8 Critical severity

  Apache Druid: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  CVE-2025-59390Nov 26, 2025Apache

  Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-gra