Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
Priority HIGH 83CWE-732Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
Why it matters now
EPSS 0.99062 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.druid:druid (Maven): 0.20.1Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Druid | 0.20.0 and earlier – 0.20.0 | — | No fix listed | CNA |
| — | org.apache.druid:druid (Maven) | before 0.20.1 | 0.20.1 | Patch available | GHSA-wrqf-rrrw-w3mg |
- Apache Druid VendorApache Affected 0.20.0 and earlier – 0.20.0 Fixed in — No fix listed CNA
- org.apache.druid:druid (Maven) Vendor— Affected before 0.20.1 Fixed in 0.20.1 Patch available GHSA-wrqf-rrrw-w3mg
Remediation
- Fix · GHSA-wrqf-rrrw-w3mg org.apache.druid:druid (Maven) Fixed in 0.20.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25646
- 2026-10-03 Alias added: GHSA-wrqf-rrrw-w3mg
References
Exploit 1
Advisory 3
- https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E
- [oss-security] 20210129 CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
- https://nvd.nist.gov/vuln/detail/CVE-2021-25646
Other 26
- [druid-dev] 20210129 Re: [druid-user] Re: CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
- [druid-dev] 20210129 Re: CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
- [announce] 20210129 Subject: [CVE-2021-25646] Apache Druid remote code execution vulnerability
- [druid-commits] 20210204 [GitHub] [druid] jihoonson merged pull request #10818: Fix CVE-2021-25646
- [druid-commits] 20210204 [GitHub] [druid] jihoonson commented on pull request #10818: Fix CVE-2021-25646
- [druid-commits] 20210204 [GitHub] [druid] jihoonson opened a new pull request #10854: [Backport] Fix CVE-2021-25646
- [druid-commits] 20210204 [druid] branch 0.21.0 updated: Fix CVE-2021-25646 (#10818) (#10854)
- [druid-commits] 20210204 [GitHub] [druid] jihoonson merged pull request #10854: [Backport] Fix CVE-2021-25646
- [druid-commits] 20210205 [GitHub] [druid] jihoonson opened a new pull request #10854: [Backport] Fix CVE-2021-25646
- [druid-commits] 20210205 [GitHub] [druid] jihoonson merged pull request #10818: Fix CVE-2021-25646
- [druid-commits] 20210205 [GitHub] [druid] jihoonson commented on pull request #10818: Fix CVE-2021-25646
- [druid-commits] 20210205 [GitHub] [druid] jihoonson merged pull request #10854: [Backport] Fix CVE-2021-25646
- [druid-dev] 20210331 Regarding the 0.21.0 release
- https://lists.apache.org/thread.html/r04fa1ba93599487c95a8497044d37f8c02a439bfcf92b4567bfb7c8f@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r121abe8014d381943b63c60615149d40bde9dc1c868bcee90d0d0848@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c45bdefc32c920b9986b941d8f@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/r4f84b542417ea46202867c0a8b3eaf3b4cfed30e09174a52122ba210@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5ef625076982aee7d23c23f07717e626b73f421fba5154d1e4de15e1@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/r7dff4790e7a5c697fc0360adf11f5aeb31cd6ad80644fffee690673c@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r87aa94e28dd21ee2252d30c63f01ab9cb5474ee5bdd98dd8d7d734aa@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra4225912f501016bc5e0ac44e14b8d6779173a3a1dc7baacaabcc9ba@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rc167d5e57f3120578718a7a458ce3e73b3830ac4efbb1b085bd06b92@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/rea9436a4063927a567d698431ddae55e760c3f876c22ac5b9813685f@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rfeb775822cd3baef1595b60f6860f5ca849eb1903236483f3297bd5c@%3Ccommits.druid.apache.org%3E
More Apache Druid vulnerabilities
- TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
- TI-2021-08525 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVSS 3.1HIGH 8.8
- TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
- TI-2025-36949 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVSS 3.1CRITICAL 9.8
- TI-2021-08526 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVSS 3.1MEDIUM 6.5
- TI-2020-01882 Injection in Apache Druid CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-25646 · CVE Program
- CVE-2021-25646 · NVD
- FIRST EPSS
- GHSA-wrqf-rrrw-w3mg · GitHub Advisory Database · CC BY 4.0
- CVE-2021-25646 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences