CVE-2026-23906: 
Java vulnerability analysis and mitigation

CVE-2026-23906 is an authentication bypass vulnerability in Apache Druid's LDAP integration, classified as Critical severity. It affects Apache Druid versions 0.17.0 through 35.x (all versions prior to 36.0.0) when the druid-basic-security extension is enabled with LDAP authentication and the underlying LDAP server permits anonymous binds. The vulnerability was disclosed on February 9–10, 2026, via the oss-security mailing list and the GitHub Advisory Database. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, oss-security).

The root cause is improper validation of LDAP authentication responses (CWE-287: Improper Authentication). When the LDAP server allows anonymous binds, Apache Druid's druid-basic-security extension incorrectly treats a successful anonymous bind — triggered by submitting a valid username with an empty password — as a successful authentication event. This means the application never verifies the user's actual credentials; it simply accepts the anonymous bind result as proof of identity. Exploitation requires three preconditions: the druid-basic-security extension must be enabled, an LDAP authenticator must be configured, and the backend LDAP server must permit anonymous binds (GitHub Advisory, oss-security).

A remote, unauthenticated attacker who knows or can enumerate a valid Druid username can gain full unauthorized access to the Apache Druid cluster. This enables access to sensitive data stored in Druid datasources, execution of arbitrary queries, and potential data manipulation. If the bypassed account holds administrative privileges, the attacker can access administrative interfaces and achieve complete compromise of the confidentiality, integrity, and availability of the Druid deployment (GitHub Advisory, oss-security).

1. Reconnaissance: Identify internet-facing or network-accessible Apache Druid instances (versions 0.17.0–35.x) using tools like Shodan, Censys, or network scanning. Confirm the Druid web console or API is reachable.
2. Verify prerequisites: Determine whether the target uses LDAP authentication by attempting to log in and observing authentication prompts or error messages indicative of LDAP backend usage.
3. Enumerate valid usernames: Attempt to identify valid Druid usernames through the Druid API (e.g., /druid-ext/basic-security/authentication/db/<authenticatorName>/users) or through error message differences between valid and invalid usernames.
4. Submit authentication bypass request: Send an HTTP authentication request to the Druid API or web console using a known valid username and an empty string as the password. If the LDAP server permits anonymous binds, Druid will treat the anonymous bind success as valid authentication.
5. Gain unauthorized access: Upon successful bypass, interact with Druid's REST API or web console as the authenticated user — querying datasources, accessing administrative endpoints, or manipulating data depending on the account's privilege level (GitHub Advisory, oss-security).

• Network: HTTP authentication requests to Druid API endpoints (e.g., /druid/coordinator/v1/, /druid-ext/basic-security/) with a valid username and an empty or blank password field; unusual volume of API calls from unexpected source IPs.
• Logs: Druid access logs showing successful authentication events for known usernames originating from unexpected IP addresses or at unusual times; LDAP server logs showing anonymous bind attempts immediately followed by Druid authentication success events.
• Application: Unexpected query execution against sensitive datasources; access to administrative Druid endpoints (e.g., /druid/coordinator/v1/rules, /druid-ext/basic-security/) from accounts not typically used for administration.
• LDAP Server Logs: Anonymous bind requests from the Druid server's IP address, particularly correlated with subsequent Druid authentication success log entries.

The immediate workaround — requiring no Druid upgrade — is to disable anonymous bind on the LDAP server. This eliminates the exploitable condition entirely and is the recommended first action for all affected deployments. The long-term fix is to upgrade Apache Druid to version 36.0.0 or later, which includes code changes to properly reject anonymous LDAP bind attempts during authentication. Organizations should also audit LDAP server configurations to ensure anonymous binds are disabled as a security baseline (GitHub Advisory, oss-security).

The vulnerability received coverage from security news outlets including SecurityOnline.info and The Hacker Wire shortly after disclosure (SecurityOnline, The Hacker Wire). It was also included in Cyble's weekly vulnerability report for the week of February 19, 2026, and noted in a vulnerability digest covering SolarWinds, Ivanti, and critical ICS exposures. Social media activity on Bluesky (infosec.skyfleet.blue) flagged the advisory shortly after publication. Red Hat also published a security advisory tracking the CVE for their product portfolio (Red Hat).