CVE-2021-25646

CVE-2021-25646 is a high-severity vulnerability in Apache Druid with a CVSS 3.x base score of 8.8. Its EPSS exploit-prediction score of 99% places it in the 100th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

Frequently asked questions

What is CVE-2021-25646?
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
How severe is CVE-2021-25646?
CVE-2021-25646 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-25646 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 99% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-25646?
CVE-2021-25646 affects Apache Druid. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-25646?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2021-25646 published?
CVE-2021-25646 was published on 2021-01-29 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Apache Druid

All CVEs affecting Apache Druid →