Critical · published February 10, 2026
🚨 An attacker with just an empty password could stroll right into your Apache Druid instance — that's how sneaky this authentication bypass vulnerability is! 🔥 Think of your Apache Druid setup like a secured vault that, due to a misconfiguration, allows anyone to walk right in if they know a username, similar to a hotel that lets people enter their rooms with just a name on a list and no keycard. This could lead to catastrophic consequences! An unauthorized user could gain access to sensitive data, execute arbitrary queries, and even manipulate or delete data. Worse yet, if the compromised account has admin privileges, they could wreak absolute havoc on your deployment, compromising everything — confidentiality, integrity, and availability — in one fell swoop!
Think of your Apache Druid setup like a secured vault that, due to a misconfiguration, allows anyone to walk right in if they know a username, similar to a hotel that lets people enter their rooms with just a name on a list and no keycard. This vulnerability arises when the druid-basic-security extension is enabled and an underlying LDAP server allows anonymous binds, which improperly validates authentication responses — treating successful anonymous binds as valid authentication, essentially rolling out the red carpet for attackers!
This could lead to catastrophic consequences! An unauthorized user could gain access to sensitive data, execute arbitrary queries, and even manipulate or delete data. Worse yet, if the compromised account has admin privileges, they could wreak absolute havoc on your deployment, compromising everything — confidentiality, integrity, and availability — in one fell swoop! First, disable anonymous binds on your LDAP server to lock up the vault and prevent exploitation. Then, as soon as possible, upgrade your Apache Druid to version 36.0.0 or later, which fixes the issue by rejecting those sneaky anonymous bind attempts. Don't wait — act now! You've got this! Secure your Druid deployment and keep those unauthorized users at bay! 🛡️