CVE-2026-23906
📋 TL;DR
This authentication bypass vulnerability in Apache Druid allows attackers to gain unauthorized access by exploiting LDAP anonymous bind configurations. Organizations using Druid with basic security extension and LDAP authentication are affected if their LDAP server permits anonymous binds.
💻 Affected Systems
- Apache Druid
📦 What is this software?
Druid by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Druid deployment including unauthorized access to sensitive data, data manipulation, administrative control, and potential data exfiltration.
Likely Case
Unauthorized access to Druid resources and sensitive data stored in datasources, with potential for data exposure and unauthorized queries.
If Mitigated
No impact if LDAP anonymous bind is disabled or Druid is upgraded to patched version.
🎯 Exploit Status
Exploitation requires knowledge of existing usernames and LDAP server allowing anonymous binds.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 36.0.0
Vendor Advisory: https://lists.apache.org/thread/2x9rv3kv6t1p577lvq4z0rl0zlt9g4sr
Restart Required: Yes
Instructions:
1. Download Apache Druid version 36.0.0 or later. 2. Stop Druid services. 3. Backup configuration and data. 4. Install new version. 5. Restart Druid services. 6. Verify authentication works correctly.
🔧 Temporary Workarounds
Disable LDAP Anonymous Bind
allConfigure LDAP server to reject anonymous bind requests
# LDAP server configuration varies by implementation
# Consult your LDAP server documentation for disabling anonymous binds
🧯 If You Can't Patch
- Disable anonymous bind on LDAP server immediately
- Implement network segmentation to restrict access to Druid instances
- Enable additional authentication layers or IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Check if using Druid versions 0.17.0-35.x with druid-basic-security extension and LDAP authentication configured, and verify LDAP server allows anonymous binds.Check Version:
Check Druid version in web UI or via API endpoint, or examine server logs for version information.Verify Fix Applied:
After upgrade to 36.0.0+, test authentication with empty password for existing users - should be rejected. Verify LDAP anonymous bind is disabled on LDAP server.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with empty passwords
- Successful authentication from unexpected sources
- LDAP anonymous bind attempts
Network Indicators:
- Authentication requests with empty password fields
- Unusual query patterns from new/unexpected sources
SIEM Query:
source="druid" AND (auth_failure OR "empty password" OR "anonymous bind")