CVE-2021-26920observed exploitation

CVE-2021-26920: vulnerability in Apache Druid

Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended

Published · Updated

Follow this CVE+ Monitor Apache Druid+ Monitor fast-xml-parser

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendepss 9.5%
from disclosure to weapon
Published on NVDJul 2
VulnCheck+261d
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
Affected products
Apache Software Foundation · Apache Druid
Related CVEs — Apache Druid

In the same product, most dangerous first.

CVE-2021-25646—Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.EPSS 99.1%CVE-2021-36749—Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)EPSS 80.9%CVE-2021-26919—Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.EPSS 35.2%CVE-2021-44791—Reflected XSS on certain HTTP endpointsEPSS 2.2%CVE-2022-28889—Clickjacking in the web consoleEPSS 1.9%CVE-2025-27888MEDIUMApache Druid: Server-Side Request Forgery and Cross-Site ScriptingEPSS 1.8%