How severe is CVE-2025-27888?

CVE-2025-27888 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-27888 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-27888?

CVE-2025-27888 affects Apache Druid. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-27888?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-27888 have an EU (EUVD) identifier?

Yes. CVE-2025-27888 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6811.

When was CVE-2025-27888 published?

CVE-2025-27888 was published on 2025-03-20 and last updated on 2026-06-17.

CVE-2025-27888

CVE-2025-27888 is a medium-severity vulnerability in Apache Druid with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
CVSS v4: 5.8
EPSS exploit prediction: 2% (74th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-6811
Weakness: CWE-79
Affected product: Apache Druid
Published: 2025-03-20
Last modified: 2026-06-17

Description

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.

Frequently asked questions

What is CVE-2025-27888?: Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.
How severe is CVE-2025-27888?: CVE-2025-27888 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-27888 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-27888?: CVE-2025-27888 affects Apache Druid. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-27888?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-27888 have an EU (EUVD) identifier?: Yes. CVE-2025-27888 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6811.
When was CVE-2025-27888 published?: CVE-2025-27888 was published on 2025-03-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Druid

CVE-2026-23906 — Critical (CVSS 9.8): Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to…
CVE-2025-59390 — Critical (CVSS 9.8): Apache Druid’s Kerberos authenticator uses a weak fallback secret when the…
CVE-2021-26919 — High (CVSS 8.8): Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted…
CVE-2021-25646 — High (CVSS 8.8): Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This…
CVE-2024-45537 — Medium (CVSS 6.5): Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This…
CVE-2021-36749 — Medium (CVSS 6.5): In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP…

All CVEs affecting Apache Druid →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →