Authentication Vulnerability in Apache Druid's Kerberos Authenticator

CVE-2025-59390

What is CVE-2025-59390?

Apache Druid's Kerberos authenticator is susceptible to an authentication bypass due to the use of a weak fallback secret. When the configuration for druid.auth.authenticator.kerberos.cookieSignatureSecret is not set, a non-cryptographically secure random number is generated, allowing potential attackers to predict or brute force the signing secret for authentication cookies. This vulnerability can lead to token forgery or bypassing authentication measures entirely. Moreover, the generation of unique fallback secrets across different processes can result in authentication errors in distributed deployments, leading to misconfigured clusters. It is crucial for users to define a strong druid.auth.authenticator.kerberos.cookieSignatureSecret to mitigate these risks, especially when upgrading to version 35.0.0, which mandates this configuration.

References