Not rated
CVE-2021-26919 Apache Druid allows users to read data from other database systems using JDBC
Description
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Druid 0.20 | earliest → 0.20.1 | No fix stated |
Other CVEs of Apache Druid
The 11 CVEs of Apache Druid →
CVE-2026-23906
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to…
Not rated
CVE-2025-59390
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the…
Not rated
CVE-2025-27888
Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web…
5.8
Medium
CVE-2024-45537
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
Not rated