Not rated
CVE-2021-26919 Apache Druid allows users to read data from other database systems using JDBC
Description
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Druid 0.20 | earliest → 0.20.1 | No fix stated |
References
- lists.apache.org lists.apache.org
- [druid-dev] 20210331 Regarding the 0.21.0 release lists.apache.org
- [druid-dev] 20210401 Re: Subject: [CVE-2021-26919] Authenticated users can execute arbitrary code from malicious MySQL database systems lists.apache.org
- [druid-commits] 20210401 [GitHub] [druid] jihoonson merged pull request #11047: Allow list for JDBC connection properties to address CVE-2021-26919 lists.apache.org
- [druid-dev] 20210405 Regarding the CVSS score for CVE-2021-26919 lists.apache.org
- [druid-dev] 20210405 Re: Regarding the CVSS score for CVE-2021-26919 lists.apache.org
- [druid-commits] 20210412 [GitHub] [druid] jihoonson opened a new pull request #11100: [Backport] Allow list for JDBC connection properties to address CVE-2021-26919 lists.apache.org
- [druid-commits] 20210412 [GitHub] [druid] jihoonson merged pull request #11100: [Backport] Allow list for JDBC connection properties to address CVE-2021-26919 lists.apache.org
- [druid-dev] 20210414 Re: Regarding the CVSS score for CVE-2021-26919 lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Druid
The 11 CVEs of Apache Druid →
CVE-2026-23906
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to…
Not rated
CVE-2025-59390
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the…
Not rated
CVE-2025-27888
Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web…
5.8
Medium
CVE-2024-45537
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
Not rated