How severe is CVE-2025-59390?

CVE-2025-59390 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-59390 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-59390?

CVE-2025-59390 affects Apache Druid. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-59390?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-59390 have an EU (EUVD) identifier?

Yes. CVE-2025-59390 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-199714.

When was CVE-2025-59390 published?

CVE-2025-59390 was published on 2025-11-26 and last updated on 2026-06-17.

CVE-2025-59390

CVE-2025-59390 is a critical-severity vulnerability in Apache Druid with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-338.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 1% (44th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-199714
Weakness: CWE-338
Affected product: Apache Druid
Published: 2025-11-26
Last modified: 2026-06-17

Description

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret` This issue affects Apache Druid: through 34.0.0. Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set.

Frequently asked questions

What is CVE-2025-59390?: Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret` This issue affects Apache Druid: through 34.0.0. Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set.
How severe is CVE-2025-59390?: CVE-2025-59390 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-59390 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-59390?: CVE-2025-59390 affects Apache Druid. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-59390?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-59390 have an EU (EUVD) identifier?: Yes. CVE-2025-59390 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-199714.
When was CVE-2025-59390 published?: CVE-2025-59390 was published on 2025-11-26 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*

More vulnerabilities in Apache Druid

CVE-2026-23906 — Critical (CVSS 9.8): Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to…
CVE-2021-26919 — High (CVSS 8.8): Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted…
CVE-2021-25646 — High (CVSS 8.8): Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This…
CVE-2024-45537 — Medium (CVSS 6.5): Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This…
CVE-2021-36749 — Medium (CVSS 6.5): In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP…
CVE-2021-26920 — Medium (CVSS 6.5): In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP…

All CVEs affecting Apache Druid →

Other CWE-338 vulnerabilities

CVE-2026-56141 — Critical (CVSS 9.8): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account…
CVE-2026-3256 — Critical (CVSS 9.8): HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults…
CVE-2025-15604 — Critical (CVSS 9.8): Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions…
CVE-2025-40926 — Critical (CVSS 9.8): Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely. The default session…
CVE-2026-2439 — Critical (CVSS 9.8): Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id…
CVE-2025-15578 — Critical (CVSS 9.8): Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the…

Browse all CWE-338 vulnerabilities →