CVE-2021-25646 Apache Druid
| Affected software | Apache Druid |
|---|---|
| Severity | 8.8 High CVSS 3.1 2 scores |
| Fixed in | 0.20.1 |
| Weakness | Incorrect permission assignment (CWE-732) |
| Published | 29 Jan 2021 |
| Updated | 17 Jun 2026 |
Description
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 1 citation · honeypot sightings · 13 exploits · earliest 2023-11-13.
- CISA Vulnrichment no assessment published
- Indexed PoC 15 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2021-02-03.
- EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-25646 in VulnCheck (free account), which lists 8 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 876 days | 2023-11-13 to 2026-11-12 |
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 11 days | 2026-10-27 to 2026-11-13 |
| Reported exploitation | aquasec.com | /blog/lucifer-ddos-botnet-malware-is-targeting-apache-big-data-stack | 2024-02-21 |
| Exploit reference | VulnCheck XDB 648dbf3f68af | Exploit type: initial-access | 2021-02-03 |
| Exploit reference | VulnCheck XDB 90e27828c0bf | Exploit type: initial-access | 2021-02-03 |
| Exploit reference | VulnCheck XDB e23be009996b | Exploit type: initial-access | 2021-02-04 |
| Exploit reference | VulnCheck XDB 762a40d94ce5 | Exploit type: initial-access | 2021-02-13 |
| Exploit reference | VulnCheck XDB ff8ab82ad27a | Exploit type: initial-access | 2021-12-02 |
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection none
- Action unverified
- Review automated Inferred
- Record active
| Decided by | The affected package being open source on Maven, so the fix can be read |
|---|---|
| Finding | This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.druid:druid), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on. |
CVSS
8.8 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
8.8 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 9.0 | none | AV:N/AC:L/Au:S/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.druid:druid |
0 | 0.20.1 |
unbounded |
References
Timeline
Timeline
| Published | 2021-01-29 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2023-11-13 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-13 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |