CVE-2025-59390

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-59390

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59390.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-59390

Aliases

GHSA-w88f-4875-99c8

Published

2025-11-26T09:15:46.033Z

Modified

2026-03-14T12:47:02.779071Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong druid.auth.authenticator.kerberos.cookieSignatureSecret

This issue affects Apache Druid: through 34.0.0.

Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set druid.auth.authenticator.kerberos.cookieSignatureSecret when using the Kerberos authenticator. Services will fail to come up if the secret is not set.

References

Affected packages

Git / github.com/apache/druid

Affected ranges

Type

GIT

Repo

https://github.com/apache/druid

Events

Introduced

Fixed

f6712c6694a2b95961607c3ceac0123418641d40

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "35.0.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59390.json"