CVE-2026-23906

CWE-287 — Improper Authentication5 documents5 sources
Severity
9.8CRITICAL
EPSS
0.1%
top 80.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache DruidApache Druid
Timeline
PublishedFeb 10

Description

Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind Vulnerability Description An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous binds, an attacker…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/druid0.17.0 — 36.0.0
▶CVEListV5apache_software_foundation/apache_druid0.17.0 — 36.0.0

🔴Vulnerability Details

3
OSV
Apache Druid Vulnerable to Authentication Bypass↗2026-02-10
▶
CVEList
Apache Druid: Authentication Bypass via LDAP Anonymous Bind↗2026-02-10
▶
GHSA
Apache Druid Vulnerable to Authentication Bypass↗2026-02-10
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-23906 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-23906 (CRITICAL CVSS 9.8) | Affected Products and Versions * Ap | cvebase.io