Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
Description
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong druid.auth.authenticator.kerberos.cookieSignatureSecret
This issue affects Apache Druid: through 34.0.0.
Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set druid.auth.authenticator.kerberos.cookieSignatureSecret when using the Kerberos authenticator. Services will fail to come up if the secret is not set.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Apache Druid's Kerberos authenticator falls back to cryptographically weak random (ThreadLocalRandom) for cookie signing, risking token forgery and authentication bypass.
Vulnerability
Details
Apache Druid's Kerberos authenticator generates a fallback secret for signing authentication cookies when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. This fallback secret is generated using ThreadLocalRandom, which is not a cryptographically secure random number generator [1][4]. As a result, the secret may be predictable or brute-forceable.
Exploitation and
Impact
An attacker with network access to Druid endpoints could predict or brute force the weak secret, enabling them to forge authentication tokens and bypass Kerberos authentication [1]. Additionally, each Druid process independently generates its own fallback secret, leading to inconsistent secrets across nodes in distributed deployments. This inconsistency can cause authentication failures and effectively misconfigure the cluster [1][4].
Mitigation
Apache Druid version 35.0.0 resolves this vulnerability by making the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration mandatory when using the Kerberos authenticator; services will fail to start if the secret is not explicitly set [2]. Users are strongly advised to upgrade to Druid 35.0.0 and ensure a strong secret is configured [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.druid:druidMaven | < 35.0.0 | 35.0.0 |
Affected products
2- Apache Software Foundation/Apache Druidv5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/advisories/GHSA-w88f-4875-99c8ghsaADVISORY
- lists.apache.org/thread/jwjltllnntgj1sb9wzsjmvwm9f8rlhg8ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-59390ghsaADVISORY
- www.openwall.com/lists/oss-security/2025/11/26/1ghsaWEB
- github.com/apache/druid/pull/18368ghsaWEB
News mentions
0No linked articles in our index yet.