CVE-2026-23906
Apache Druid: Authentication Bypass via LDAP Anonymous Bind
Description
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind Vulnerability Description An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials. The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication. Impact A remote, unauthenticated attacker can: * Gain unauthorized access to the Apache Druid cluster * Access sensitive data stored in Druid datasources * Execute queries and potentially manipulate data * Access administrative interfaces if the bypassed account has elevated privileges * Completely compromise the confidentiality, integrity, and availability of the Druid deployment Mitigation Immediate Mitigation (No Druid Upgrade Required): * Disable anonymous bind on your LDAP server. This prevents the vulnerability from being exploitable and is the recommended immediate action. Resolution * Upgrade Apache Druid to version 36.0.0 or later, which includes fixes to properly reject anonymous LDAP bind attempts.
INFO
Published Date :
Feb. 10, 2026, 10:15 a.m.
Last Modified :
Feb. 12, 2026, 5:16 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Disable anonymous bind on your LDAP server.
- Upgrade Apache Druid to version 36.0.0 or later.
Public PoC/Exploit Available at Github
CVE-2026-23906 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-23906.
| URL | Resource |
|---|---|
| https://lists.apache.org/thread/2x9rv3kv6t1p577lvq4z0rl0zlt9g4sr | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/02/09/5 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-23906 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-23906
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Proof-of-concept exploits and reproduction labs for CVEs analyzed by the Exploit Intelligence Platform
cves exploits proof-of-concept
Shell Python PHP Ruby JavaScript C# Java HTML C
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-23906 vulnerability anywhere in the article.
-
Daily CyberSecurity
CVE-2026-23906: Authentication Bypass Flaw Hits Apache Druid Analytics Clusters
The Apache Software Foundation has released a security update for Apache Druid, the high-performance real-time analytics database, to fix a glaring hole in its authentication logic. Tracked as CVE-202 ... Read more
The following table lists the changes that have been made to the
CVE-2026-23906 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Feb. 12, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/02/09/5 -
Initial Analysis by [email protected]
Feb. 11, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:* versions from (including) 0.17.0 up to (excluding) 36.0.0 Added Reference Type Apache Software Foundation: https://lists.apache.org/thread/2x9rv3kv6t1p577lvq4z0rl0zlt9g4sr Types: Mailing List, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Feb. 10, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by [email protected]
Feb. 10, 2026
Action Type Old Value New Value Added Description Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind Vulnerability Description An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials. The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication. Impact A remote, unauthenticated attacker can: * Gain unauthorized access to the Apache Druid cluster * Access sensitive data stored in Druid datasources * Execute queries and potentially manipulate data * Access administrative interfaces if the bypassed account has elevated privileges * Completely compromise the confidentiality, integrity, and availability of the Druid deployment Mitigation Immediate Mitigation (No Druid Upgrade Required): * Disable anonymous bind on your LDAP server. This prevents the vulnerability from being exploitable and is the recommended immediate action. Resolution * Upgrade Apache Druid to version 36.0.0 or later, which includes fixes to properly reject anonymous LDAP bind attempts. Added CWE CWE-287 Added Reference https://lists.apache.org/thread/2x9rv3kv6t1p577lvq4z0rl0zlt9g4sr