Read the docs
TI-2024-30561 Aliases CVE-2024-45537GHSA-jh66-3545-vpm7

Apache Druid: Users can provide MySQL JDBC properties not on allow list

Priority LOW 30CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide for their JDBC connections. By default, this allowed properties list restricts users to TLS-related properties only. However, when configuration a MySQL JDBC connection, users can use a particularly-crafted JDBC connection string to provide properties that are not on this allow list. Users without the permission to configure JDBC connections are not able to exploit this vulnerability. CVE-2021-26919 describes a similar vulnerability which was partially addressed in Apache Druid 0.20.2. This issue is fixed in Apache Druid 30.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00626 50th percentileScored 2026-11-07
Fix Fixed org.apache.druid:druid (Maven): 30.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Druidup to 30.0.0—No fix listedCNA
—org.apache.druid:druid (Maven)before 30.0.130.0.1Patch availableGHSA-jh66-3545-vpm7
  • Apache Druid VendorApache Affected up to 30.0.0 Fixed in — No fix listed CNA
  • org.apache.druid:druid (Maven) Vendor— Affected before 30.0.1 Fixed in 30.0.1 Patch available GHSA-jh66-3545-vpm7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*before 30.0.1VulnerableApache
  • cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:* Versions before 30.0.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-jh66-3545-vpm7 org.apache.druid:druid (Maven) Fixed in 30.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45537
  2. 2026-10-03 Alias added: GHSA-jh66-3545-vpm7
  3. 2026-10-31 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 2

  • TI-2021-07779 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVSS 3.1HIGH 8.8
  • TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
  • TI-2021-08525 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVSS 3.1HIGH 8.8
  • TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
  • TI-2025-36949 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVSS 3.1CRITICAL 9.8
  • TI-2021-08526 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences