Read the docs
TI-2025-20620 Aliases CVE-2025-27888GHSA-2xcr-p767-f3rv

Apache Druid: Server-Side Request Forgery and Cross-Site Scripting

Priority LOW 30CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing, Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601 and CWE-79.

Summary

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01947 80th percentileScored 2026-11-07
Fix Fixed Apache Druid (Apache Software Foundation): 31.0.2org.apache.druid:druid (Maven): 31.0.2, 32.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Druidbefore 31.0.2; 32.0.031.0.2Patch availableCNA
—org.apache.druid:druid (Maven)before 31.0.231.0.2Patch availableGHSA-2xcr-p767-f3rv
—org.apache.druid:druid (Maven)32.0.0 to before 32.0.132.0.1Patch availableGHSA-2xcr-p767-f3rv
  • Apache Druid VendorApache Affected before 31.0.2; 32.0.0 Fixed in 31.0.2 Patch available CNA
  • org.apache.druid:druid (Maven) Vendor— Affected before 31.0.2 Fixed in 31.0.2 Patch available GHSA-2xcr-p767-f3rv
  • org.apache.druid:druid (Maven) Vendor— Affected 32.0.0 to before 32.0.1 Fixed in 32.0.1 Patch available GHSA-2xcr-p767-f3rv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*before 31.0.2VulnerableApache
  • cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:* Versions before 31.0.2 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Druid (Apache Software Foundation) Fixed in 31.0.2
  • Fix · GHSA-2xcr-p767-f3rv org.apache.druid:druid (Maven) Fixed in 31.0.2 Advisory →
  • Fix · GHSA-2xcr-p767-f3rv org.apache.druid:druid (Maven) Fixed in 32.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27888
  2. 2026-10-03 Alias added: GHSA-2xcr-p767-f3rv

References

Advisory 3

Other 3

  • TI-2021-07779 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVSS 3.1HIGH 8.8
  • TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
  • TI-2021-08525 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVSS 3.1HIGH 8.8
  • TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
  • TI-2025-36949 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CVSS 3.1CRITICAL 9.8
  • TI-2021-08526 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences