Apache Druid: Authentication Bypass via LDAP Anonymous Bind

Vulnerability

CVE-2026-23906 is an authentication bypass vulnerability in Apache Druid affecting versions 0.17.0 through 35.x (prior to 36.0.0) when the druid-basic-security extension is enabled with LDAP authentication [1][2]. The root cause is improper validation of LDAP authentication responses when the underlying LDAP server permits anonymous binds [1]. If an attacker provides an existing username with an empty password, Druid treats the anonymous bind success as valid user authentication, bypassing credential verification [1][2].

Exploitation

Exploitation requires: the druid-basic-security extension enabled, LDAP authenticator configured, and an LDAP server that allows anonymous binds [1][2]. A remote, unauthenticated attacker can supply any valid Druid username and an empty password over the network; if the LDAP server accepts the anonymous bind, Druid incorrectly authenticates the attacker as that user [1][2]. No prior authentication is needed, and the attack does not depend on knowledge of the user's real password [2].

Impact

Successful exploitation grants the attacker unauthorized access to the Druid cluster with the privileges of the bypassed user [1][2]. The attacker can access sensitive data in Druid datasources, execute queries, and potentially modify or delete data. If the impersonated account has administrative privileges, the attacker can also access administrative interfaces, leading to complete compromise of confidentiality, integrity, and availability [1][2].

Mitigation

The Apache Druid project has released version 36.0.0 which fixes the vulnerability [1][2]. Users who cannot upgrade immediately should ensure their LDAP server does not permit anonymous binds, or disable the druid-basic-security extension if LDAP anonymous bind is required for other purposes [1]. No workaround is described for scenarios where the LDAP server configuration cannot be changed [2].