Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.druid.extensions:druid-basic-security

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3MavenPublished

    Apache Druid Vulnerable to Authentication Bypass

    CVE-2026-23906 · GHSA-q672-hfc7-g833

    Affected
    • Maven org.apache.druid.extensions:druid-basic-security >= 0.17.0, < 36.0.0
    Fixed in
    36.0.0· Vendor fix available
    Issue
    Affected Products and Versions Apache Druid Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) Prerequisites: druid-basic-security extension enabled LDAP authenticator configured Underlying LDAP server permits anonymous bind Vulnerability Description An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials. The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication. Impact A remote, unauthenticated attacker can: Gain unauthorized access to the Apache Druid cluster Access sensitive data stored in Druid…

    Recommended action: Upgrade to 36.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →