CVE-2026-23906: Apache Druid Authentication Bypass Vulnerability
Summary
CVE-2026-23906: Apache Druid Vulnerable to Authentication Bypass. Affects org.apache.druid.extensions:druid-basic-security versions >= 0.17.0, < 36.0.0. Fixed in 36.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Druid is a high-performance analytics data store designed for fast queries on large datasets. It is widely used for real-time data ingestion and analytics, offering features like flexible data modeling, high availability, and scalability. However, certain versions of Druid are vulnerable to an authentication bypass issue when using the druid-basic-security extension with LDAP authentication, particularly if the underlying LDAP server allows anonymous binds.
Vulnerability Detail
The vulnerability arises from improper validation of LDAP authentication responses when anonymous binds are permitted. An attacker can exploit this flaw by providing an existing username with an empty password, thereby bypassing authentication. This allows unauthorized access to restricted Druid resources, enabling the attacker to access sensitive data, execute queries, and potentially manipulate data. The impact is severe, as it compromises the confidentiality, integrity, and availability of the Druid deployment.
How To Fix
Latest published version: 38.0.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
36.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, disable anonymous bind on your LDAP server. This action prevents the vulnerability from being exploited and is the recommended immediate measure.
Conclusion
The authentication bypass vulnerability in Apache Druid poses a significant risk to users of affected versions. Immediate action is required to either upgrade to the patched version or implement the recommended workaround to mitigate potential exploitation.
See every vulnerability recorded for org.apache.druid.extensions:druid-basic-security →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
Affected versions include Apache Druid from 0.17.0 through 35.x, specifically all versions prior to 36.0.0.
The prerequisites include having the druid-basic-security extension enabled, an LDAP authenticator configured, and the underlying LDAP server permitting anonymous binds.
An attacker can gain unauthorized access to the Apache Druid cluster, access sensitive data, execute queries, and potentially manipulate data.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the pom.xml file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
