Read the docs
TI-2025-36949 Aliases CVE-2025-59390GHSA-w88f-4875-99c8

Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

Priority MEDIUM 50CWE-338Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret` This issue affects Apache Druid: through 34.0.0. Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00701 53rd percentileScored 2026-11-07
Fix Fixed org.apache.druid:druid (Maven): 35.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Druidup to 34.0.0—No fix listedCNA
—org.apache.druid:druid (Maven)before 35.0.035.0.0Patch availableGHSA-w88f-4875-99c8
  • Apache Druid VendorApache Affected up to 34.0.0 Fixed in — No fix listed CNA
  • org.apache.druid:druid (Maven) Vendor— Affected before 35.0.0 Fixed in 35.0.0 Patch available GHSA-w88f-4875-99c8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*before 35.0.0VulnerableApache
  • cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:* Versions before 35.0.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-w88f-4875-99c8 org.apache.druid:druid (Maven) Fixed in 35.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59390
  2. 2026-10-03 Alias added: GHSA-w88f-4875-99c8
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 2

  • TI-2021-07779 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. CVSS 3.1HIGH 8.8
  • TI-2021-14874 Incorrect authorization in Apache Druid CVSS 3.1MEDIUM 6.5
  • TI-2021-08525 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. CVSS 3.1HIGH 8.8
  • TI-2026-19261 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CVSS 3.1CRITICAL 9.8
  • TI-2021-08526 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended CVSS 3.1MEDIUM 6.5
  • TI-2020-01882 Injection in Apache Druid CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences