Read the docs
TI-2024-30433 Aliases CVE-2024-45384GHSA-p72w-r6fv-6g5h

Information disclosure through error messages in Apache Druid

Priority LOW 26CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-209 and CWE-347.

Summary

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by default, Druid installations not using the druid-pac4j extension are not affected by this vulnerability. While we are not aware of a way to meaningfully exploit this flaw, we nevertheless recommend upgrading to version 30.0.1 or higher which fixes the issue and ensuring you have a strong druid.auth.pac4j.cookiePassphrase as a precaution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00821 57th percentileScored 2026-11-07
Fix Fixed org.apache.druid.extensions:druid-pac4j (Maven): 30.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Druid0.18.0 – 30.0.0—No fix listedCNA
—org.apache.druid.extensions:druid-pac4j (Maven)0.18.0 to before 30.0.130.0.1Patch availableGHSA-p72w-r6fv-6g5h
  • Apache Druid VendorApache Affected 0.18.0 – 30.0.0 Fixed in — No fix listed CNA
  • org.apache.druid.extensions:druid-pac4j (Maven) Vendor— Affected 0.18.0 to before 30.0.1 Fixed in 30.0.1 Patch available GHSA-p72w-r6fv-6g5h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*0.18.0 to before 30.0.1VulnerableApache
  • cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:* Versions 0.18.0 to before 30.0.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-p72w-r6fv-6g5h org.apache.druid.extensions:druid-pac4j (Maven) Fixed in 30.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45384
  2. 2026-10-03 Alias added: GHSA-p72w-r6fv-6g5h

References

Advisory 2

Other 4

  • TI-2021-07779 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVSS 3.1HIGH 8.8
  • TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
  • TI-2021-08525 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVSS 3.1HIGH 8.8
  • TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
  • TI-2025-36949 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVSS 3.1CRITICAL 9.8
  • TI-2021-08526 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences