Critical · published November 26, 2025
🔥 A relaxed secret could give attackers the keys to your cookies! Without a strong `cookieSignatureSecret`, predicting or brute-forcing it is shockingly easy. ⚡ Think of it like a restaurant kitchen where each chef creates their own recipe for the house special without a shared, secret recipe. If one chef has a weak recipe, customers could get a counterfeit dish that ruins the dining experience. In this case, each Druid node generating its own weak secret leads to inconsistent and insecure authentication. An attacker could forge authentication tokens, allowing unauthorized access to your system — an absolutely devastating blow to your security. In distributed setups, this inconsistency can cause authentication failures across nodes, effectively locking you out of your own data!
Think of it like a restaurant kitchen where each chef creates their own recipe for the house special without a shared, secret recipe. If one chef has a weak recipe, customers could get a counterfeit dish that ruins the dining experience. In this case, each Druid node generating its own weak secret leads to inconsistent and insecure authentication. The vulnerability in Apache Druid's Kerberos authenticator arises from using a non-cryptographic random number generator for the `cookieSignatureSecret` when not explicitly set, allowing predictability and brute-force attacks to succeed.
An attacker could forge authentication tokens, allowing unauthorized access to your system — an absolutely devastating blow to your security. In distributed setups, this inconsistency can cause authentication failures across nodes, effectively locking you out of your own data! To secure your Druid setup, immediately upgrade to version 35.0.0, which mandates setting a strong `cookieSignatureSecret`. Ensure all relevant configurations are in place to prevent authentication bypass, and check your cluster for consistency across nodes. You're on the right track to bolstering your defenses! Follow these steps, and security hero status: activated! 🛡️