Druid

Vendor:

First CVE: Apr 1, 2020 · Active for 6 years

12
Total CVEs
More Total CVEs than 90% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 42% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Druid over time

Volume of CVEsAvg CVSS Base Score
First CVE
Apr 1, 2020
6 years ago
Most Recent CVE
Feb 10, 2026
164 days ago

CVE Severity & Scoring

Druid12 CVEs
All CVEs352,231 CVEs
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network12 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None9 (75.0%)
Unknown0 (0.0%)
Required3 (25.0%)
Privileges Required
Low7 (58.3%)
High0 (0.0%)
None5 (41.7%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (12 CVEs).

12 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2021-25646HIGH
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments,
Jan 29, 20218.891NOYES
CVE-2021-36749MEDIUM
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other
Sep 24, 20216.576NOYES
CVE-2021-26919HIGH
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit
Mar 30, 20218.847NONO
CVE-2025-59390CRITICAL
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this ca
Nov 26, 20259.835NONO
CVE-2026-23906CRITICAL
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension e
Feb 10, 20269.832NONO
CVE-2025-27888MEDIUM
Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Unt
Mar 20, 20255.429NOYES
CVE-2021-26920MEDIUM
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other
Jul 2, 20216.526NONO
CVE-2021-44791MEDIUM
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflecte
Jul 7, 20226.122NONO
CVE-2020-1958MEDIUM
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier
Apr 1, 20206.520NONO
CVE-2024-45537MEDIUM
Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run inges
Sep 17, 20246.519NONO
View all 12 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (12 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
8.3% of CVEs· 97th percentile
Nuclei
3 CVEs
25.0% of CVEs· 98th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (12 CVEs).

Media Mentions

Signals from CVEs in this product scope (12 CVEs).

Top CNAs Publishing CVEs For Druid

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
0.17.016.54.6%00