Authentication Bypass in Apache Druid with LDAP Authentication

CVE-2026-23906

What is CVE-2026-23906?

An authentication bypass vulnerability in Apache Druid occurs when the druid-basic-security extension is used with LDAP authentication. If an LDAP server allows anonymous binds, attackers can bypass authentication by using valid usernames with empty passwords, resulting in unauthorized access to protected resources. This vulnerability arises from inadequate validation of LDAP responses to anonymous binds, leading to serious risks such as unauthorized data access, execution of queries, and potential manipulation of sensitive information stored in Druid datasources. To mitigate this risk, it is essential to disable anonymous bind on the LDAP server immediately. Additionally, upgrading to Apache Druid version 36.0.0 or later is highly recommended to address this vulnerability.

References