PT-2025-48133 · Apache · Apache Druid

1Nfocalypse + 1 · Published 2025-11-26 · Updated 2025-12-04 · CVE-2025-59390

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Druid versions prior to 35.0.0

Description The Apache Druid Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. The secret is generated using ThreadLocalRandom, which is not a cryptographically secure random number generator. This could allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Each process generates its own fallback secret, resulting in inconsistent secrets across nodes, causing authentication failures in distributed or multi-broker deployments.

Recommendations Versions prior to 35.0.0 should be upgraded to version 35.0.0, which fixes the issue and makes it mandatory to set druid.auth.authenticator.kerberos.cookieSignatureSecret when using the Kerberos authenticator. Services will fail to start if the secret is not set.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-59390

GHSA-W88F-4875-99C8

Affected Products

Apache Druid

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-59390 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59390 · Vendor Advisory
• https://lists.apache.org/thread/jwjltllnntgj1sb9wzsjmvwm9f8rlhg8 · Vendor Advisory
• https://reddit.com/r/VulnMatter/comments/1pbe9h1/resumen_diario_de_vulnerabilidades_01122025 · Reddit Post
• https://twitter.com/CVEnew/status/1993610438983221344 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1995750621295661309 · Twitter Post
• https://t.me/cveNotify/144059 · Telegram Post
• https://twitter.com/autumn_good_35/status/1994037330899059020 · Twitter Post
• https://t.me/CVEtracker/38280 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1p9dokj/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post
• https://twitter.com/oss_security/status/1996682613860491611 · Twitter Post
• http://openwall.com/lists/oss-security/2025/11/26/1 · Note
• https://reddit.com/r/VulnMatter/comments/1p9ah42/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p8bkgw/resumen_diario_de_vulnerabilidades_27112025 · Reddit Post
• https://twitter.com/cracbot/status/1995447847718903956 · Twitter Post