Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Druid | Apache Druid – 0.20.2 | — | No fix listed | CNA |
| — | org.apache.druid:druid-core (Maven) | before 0.21.0 | 0.21.0 | Patch available | GHSA-793h-6f7r-6qvm |
- Apache Druid VendorApache Affected Apache Druid – 0.20.2 Fixed in — No fix listed CNA
- org.apache.druid:druid-core (Maven) Vendor— Affected before 0.21.0 Fixed in 0.21.0 Patch available GHSA-793h-6f7r-6qvm
Remediation
- Fix · GHSA-793h-6f7r-6qvm org.apache.druid:druid-core (Maven) Fixed in 0.21.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26920
- 2026-10-03 Alias added: GHSA-793h-6f7r-6qvm
References
Advisory 4
- https://lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3E
- [oss-security] 20210702 CVE-2021-26920: Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
- [oss-security] 20210923 CVE-2021-36749: Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)
- https://nvd.nist.gov/vuln/detail/CVE-2021-26920
Other 6
- [announce] 20210701 CVE-2021-26920: Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
- [druid-dev] 20210923 CVE-2021-36749: Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)
- [announce] 20210923 CVE-2021-36749: Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)
- https://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6de5c7c40dd92dab7518746fbaa2@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d@%3Cdev.druid.apache.org%3E
More Apache Druid vulnerabilities
- TI-2021-07779 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVSS 3.1HIGH 8.8
- TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
- TI-2021-08525 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVSS 3.1HIGH 8.8
- TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
- TI-2025-36949 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVSS 3.1CRITICAL 9.8
- TI-2020-01882 Injection in Apache Druid CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-26920 · CVE Program
- CVE-2021-26920 · NVD
- FIRST EPSS
- GHSA-793h-6f7r-6qvm · GitHub Advisory Database · CC BY 4.0
- CVE-2021-26920 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences