CVE-2025-59390: Apache Druid's Kerberos Authenticator Vulnerability Due to Weak Fallback Secret
Summary
CVE-2025-59390: Apache Druid’s Kerberos authenticator uses a weak fallback secret. Affects org.apache.druid:druid versions < 35.0.0. Fixed in 35.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Druid is a high-performance, real-time analytics database designed for fast data ingestion and flexible querying. It is widely used for analytics on large datasets, providing features such as real-time data processing, high availability, and scalability. However, it has a vulnerability in its Kerberos authenticator that can compromise the security of authentication cookies.
Vulnerability Detail
The vulnerability arises from Apache Druid's Kerberos authenticator using a weak fallback secret when the configuration parameter 'druid.auth.authenticator.kerberos.cookieSignatureSecret' is not explicitly set. The fallback secret is generated using 'ThreadLocalRandom', which is not cryptographically secure. This allows attackers to potentially predict or brute-force the secret, leading to token forgery or authentication bypass. Additionally, each Druid process generates its own fallback secret, causing inconsistencies across nodes and resulting in authentication failures in distributed deployments.
How To Fix
Latest published version: 38.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
35.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually set a strong value for 'druid.auth.authenticator.kerberos.cookieSignatureSecret' in their configuration file to avoid using the weak fallback secret. Example configuration:
druid.auth.authenticator.kerberos.cookieSignatureSecret=your_strong_secret_value
Conclusion
In summary, the vulnerability in Apache Druid's Kerberos authenticator due to a weak fallback secret poses significant security risks. Users are strongly advised to upgrade to version 35.0.0 or later and configure a strong cookie signature secret to protect against potential attacks.
See every vulnerability recorded for org.apache.druid:druid →
FAQ
The vulnerability can lead to token forgery or authentication bypass, allowing unauthorized access to the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
If an immediate upgrade is not possible, ensure that 'druid.auth.authenticator.kerberos.cookieSignatureSecret' is set to a strong value to mitigate the risk.
More information about Apache Druid can be found on its official website and documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.druid:druid.
