CVE-2021-26920 Druid
| Affected software | Druid |
|---|---|
| Severity | 6.5 Medium CVSS 3.1 2 scores |
| Fixed in | 0.21.0 |
| Weakness | Incorrect authorization (CWE-863) |
| Published | 2 Jul 2021 |
| Updated | 17 Jun 2026 |
Description
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
CWE-610
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. Honeypot sightings · earliest 2022-03-20.
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 9.5% chance in 30 days
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-26920 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | SANS DShield sensors | Exploitation attempts seen on 1 day | 2022-03-20 |
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection none
- Action unverified
- Review automated Inferred
- Record active
| Decided by | The affected package being open source on Maven, so the fix can be read |
|---|---|
| Finding | This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.druid:druid-core), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on. |
CVSS
6.5 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
6.5 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.0 | none | AV:N/AC:L/Au:S/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.druid:druid-core |
0 | 0.21.0 |
unbounded |
Products and versions
2 products, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | druid | generic | ＜ 0.22.0 |
| osv | org.apache.druid | druid-core | generic | ＜ 0.21.0 |
References
Timeline
Timeline
| Published | 2021-07-02 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2022-03-20 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |