Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.
Priority MEDIUM 64CWE-668Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
Why it matters now
EPSS 0.35192 98th percentileScored 2026-11-08
Fix Fixed org.apache.druid:druid (Maven): 0.20.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Druid | Apache Druid – 0.20.1 | — | No fix listed | CNA |
| — | org.apache.druid:druid (Maven) | before 0.20.2 | 0.20.2 | Patch available | GHSA-jj4f-p7vv-j4v9 |
- Apache Druid VendorApache Affected Apache Druid – 0.20.1 Fixed in — No fix listed CNA
- org.apache.druid:druid (Maven) Vendor— Affected before 0.20.2 Fixed in 0.20.2 Patch available GHSA-jj4f-p7vv-j4v9
Remediation
- Fix · GHSA-jj4f-p7vv-j4v9 org.apache.druid:druid (Maven) Fixed in 0.20.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26919
- 2026-10-03 Alias added: GHSA-jj4f-p7vv-j4v9
References
Advisory 2
Other 19
- [druid-dev] 20210331 Regarding the 0.21.0 release
- [druid-dev] 20210401 Re: Subject: [CVE-2021-26919] Authenticated users can execute arbitrary code from malicious MySQL database systems
- [druid-commits] 20210401 [GitHub] [druid] jihoonson merged pull request #11047: Allow list for JDBC connection properties to address CVE-2021-26919
- [druid-dev] 20210405 Regarding the CVSS score for CVE-2021-26919
- [druid-dev] 20210405 Re: Regarding the CVSS score for CVE-2021-26919
- [druid-commits] 20210412 [GitHub] [druid] jihoonson opened a new pull request #11100: [Backport] Allow list for JDBC connection properties to address CVE-2021-26919
- [druid-commits] 20210412 [GitHub] [druid] jihoonson merged pull request #11100: [Backport] Allow list for JDBC connection properties to address CVE-2021-26919
- [druid-dev] 20210414 Re: Regarding the CVSS score for CVE-2021-26919
- https://github.com/apache/druid/commit/48953e3508967f5156c69676432b5d4dd25ea678
- https://github.com/apache/druid
- https://github.com/apache/druid/releases/tag/druid-0.20.2
- https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/r470f8c92eb5df45f41b3ae609b6315b6c5ff51b3ceb2f09f00ca620f@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/r6bc68264170046448f823d12c17fd1fd875251d97d60869f58709872@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r7a531ec123570cb7875ff991cf115f99e9ef99a48b3cf3fa4f9d9864@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra85fa7d31f9bec1148ffd2e4030934927caa8bff89bca9f61f75e697@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/re0910cf4c784897774427fecd95912fb565a6bd06d924a55e70bbbfc@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/re4c5deb0aae4bace69844d15c9fd1699e907ebfee93bc3926474d110@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/rf3ea2a4018e87e6c45d36cf8479af7727dcc276edabd2f7cf59e0c5f@%3Cdev.druid.apache.org%3E
More Apache Druid vulnerabilities
- TI-2021-07779 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVSS 3.1HIGH 8.8
- TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
- TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
- TI-2025-36949 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVSS 3.1CRITICAL 9.8
- TI-2021-08526 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVSS 3.1MEDIUM 6.5
- TI-2020-01882 Injection in Apache Druid CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-26919 · CVE Program
- CVE-2021-26919 · NVD
- FIRST EPSS
- GHSA-jj4f-p7vv-j4v9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences