CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

Security readout for executives and security teams

CVE-2021-25646 lets an authenticated Apache Druid user make the server run user-supplied JavaScript even when that feature is disabled. Successful abuse can execute code with the Druid server process privileges. This is primarily a risk for exposed or weakly governed Druid deployments running version 0.20.0 or earlier. Organizations are exposed if they run Apache Druid 0.20.0 or earlier and allow authenticated users, services, or compromised credentials to submit affected request types. Internet exposure, shared analytics environments, or broad Druid user access increase business risk. Treat this as a high-priority remediation item for any affected Druid deployment. The vulnerability requires authentication, but it crosses from application access to server code execution, which can threaten data platforms, credentials, and adjacent systems. Mitigation focus: Upgrade Apache Druid using vendor guidance for CVE-2021-25646.; Prioritize Druid 0.20.0 and earlier instances for remediation.; Restrict Druid access to trusted users and networks..

Prepared

Jun 3, 2026, 03:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.