Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-26919

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-26919
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 07:09 UTC · Revision 1

Source evidence

CVE-2021-26919

core-osv · Original source

Published 30 Mar 2021, 08:15 UTC

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2

osv:CVE-2021-26919
Complete source record
{
  "id": "49f2039ea3c256e30e8d2bff273d52bf9ef76c870c537c9f385395405365719b",
  "url": "https://osv.dev/vulnerability/CVE-2021-26919",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-26919",
    "summary": "Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2",
    "evidence": "osv:CVE-2021-26919",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-26919",
      "aliases": [
        "CVE-2021-26919",
        "GHSA-jj4f-p7vv-j4v9"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/apache/druid",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "8f2a2903a8824c578980a231908b52ba0b4eddba"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.20.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "druid-0.20.1-rc1",
            "druid-0.20.1",
            "druid-0.8.0-rc1",
            "druid-0.7.1",
            "druid-0.7.1-rc1",
            "druid-0.7.0",
            "druid-0.7.0-rc3",
            "druid-0.7.0-rc2",
            "druid-0.7.0-rc1",
            "druid-0.6.160",
            "druid-0.6.159",
            "druid-0.6.158",
            "druid-0.6.157",
            "druid-0.6.156",
            "druid-0.6.155",
            "druid-0.6.154",
            "druid-0.6.153",
            "druid-0.6.152",
            "druid-0.6.151",
            "druid-0.6.150",
            "druid-0.6.149",
            "druid-0.6.148",
            "druid-0.6.147",
            "druid-0.6.146",
            "druid-0.6.145",
            "druid-0.6.144",
            "druid-0.6.143",
            "druid-0.6.142",
            "druid-0.6.141",
            "druid-0.6.140",
            "druid-0.6.139",
            "druid-0.6.138",
            "druid-0.6.121",
            "druid-0.6.137",
            "druid-0.6.136",
            "druid-0.6.135",
            "druid-0.6.134",
            "druid-0.6.133",
            "druid-0.6.132",
            "druid-0.6.131",
            "druid-0.6.130",
            "druid-0.6.129",
            "druid-0.6.128",
            "druid-0.6.127",
            "druid-0.6.126",
            "druid-0.6.125",
            "druid-0.6.124",
            "druid-0.6.123",
            "druid-0.6.122",
            "druid-0.6.120",
            "druid-0.6.119",
            "druid-0.6.118",
            "druid-0.6.117",
            "druid-0.6.116",
            "druid-0.6.115",
            "druid-0.6.114",
            "druid-0.6.113",
            "druid-0.6.112",
            "druid-0.6.111",
            "druid-0.6.110",
            "druid-0.6.109",
            "druid-0.6.108",
            "druid-0.6.107",
            "druid-0.6.106",
            "druid-0.6.105",
            "druid-0.6.104",
            "druid-0.6.103",
            "druid-0.6.102",
            "druid-0.6.101",
            "druid-0.6.100",
            "druid-0.6.99",
            "druid-0.6.98",
            "druid-0.6.97",
            "druid-0.6.96",
            "druid-0.6.95",
            "druid-0.6.94",
            "druid-0.6.93",
            "druid-0.6.92",
            "druid-0.6.91",
            "druid-0.6.81",
            "druid-0.6.90",
            "druid-0.6.89",
            "druid-0.6.88",
            "druid-0.6.87",
            "druid-0.6.86",
            "druid-0.6.85",
            "druid-0.6.84",
            "druid-0.6.83",
            "druid-0.6.82",
            "druid-0.6.79",
            "druid-0.6.78",
            "druid-0.6.77",
            "druid-0.6.76",
            "druid-0.6.75",
            "druid-0.6.74",
            "druid-0.6.73",
            "druid-0.6.72",
            "druid-0.6.71",
            "druid-0.6.70",
            "druid-0.6.69",
            "druid-0.6.68",
            "druid-0.6.66",
            "druid-0.6.65",
            "druid-0.6.64",
            "druid-0.6.63",
            "druid-0.6.62",
            "druid-0.6.61",
            "druid-0.6.60",
            "druid-0.6.59",
            "druid-0.6.58",
            "druid-0.6.57",
            "druid-0.6.56",
            "druid-0.6.55",
            "druid-0.6.54",
            "druid-0.6.52",
            "druid-0.6.53",
            "druid-0.6.51",
            "druid-0.6.50",
            "druid-0.6.49",
            "druid-0.6.48",
            "druid-0.6.47",
            "druid-0.6.46",
            "druid-0.6.45",
            "druid-0.6.42",
            "druid-0.6.41",
            "druid-0.6.40",
            "druid-0.6.39",
            "druid-0.6.38",
            "druid-0.6.37",
            "druid-0.6.36",
            "druid-0.6.35",
            "druid-0.6.34",
            "druid-0.6.33",
            "druid-0.6.32",
            "druid-0.6.31",
            "druid-0.6.30",
            "druid-0.6.29",
            "druid-0.6.28",
            "druid-0.6.27",
            "druid-0.6.26",
            "druid-0.6.25",
            "druid-0.6.24",
            "druid-0.6.23",
            "druid-0.6.22",
            "druid-0.6.21",
            "druid-0.6.20",
            "druid-0.6.19",
            "druid-0.6.18",
            "druid-0.6.17",
            "druid-0.6.16",
            "druid-0.6.15",
            "druid-0.6.14",
            "druid-0.6.13",
            "druid-0.6.12",
            "druid-0.6.11",
            "druid-0.6.10",
            "druid-0.6.9",
            "druid-0.6.8",
            "druid-0.6.7",
            "druid-0.6.5",
            "druid-0.6.4",
            "druid-0.6.3",
            "druid-0.6.2",
            "druid-0.6.1",
            "druid-0.5.49",
            "druid-0.5.54",
            "druid-0.6.0",
            "druid-0.5.58",
            "druid-0.5.57",
            "druid-0.5.56",
            "druid-0.5.53",
            "druid-0.5.52",
            "druid-0.5.51",
            "druid-0.5.48",
            "druid-0.5.47",
            "druid-0.5.46",
            "druid-0.5.45",
            "druid-0.5.44",
            "druid-0.5.43",
            "druid-0.5.42",
            "druid-0.5.41",
            "druid-0.5.39",
            "druid-0.5.38",
            "druid-0.5.35",
            "druid-0.5.34",
            "druid-0.5.33",
            "druid-0.5.32",
            "druid-0.5.31",
            "druid-0.5.30",
            "druid-0.5.29",
            "druid-0.5.27",
            "druid-0.5.26",
            "druid-0.5.25",
            "druid-0.5.24",
            "druid-0.5.23",
            "druid-0.5.22",
            "druid-0.5.21",
            "druid-0.5.20",
            "druid-0.5.19",
            "druid-0.5.18",
            "druid-0.5.17",
            "druid-0.5.16",
            "druid-0.5.15",
            "druid-0.5.14",
            "druid-0.5.13",
            "druid-0.5.11",
            "druid-0.5.10",
            "druid-0.5.9",
            "druid-0.5.8",
            "druid-0.5.7",
            "druid-0.5.5",
            "druid-0.5.3",
            "druid-0.4.32",
            "druid-0.5.2",
            "druid-0.5.1",
            "druid-0.5.0",
            "druid-0.4.31",
            "druid-0.4.30",
            "druid-0.4.29",
            "druid-0.4.28",
            "druid-0.4.27",
            "druid-0.4.26",
            "druid-0.4.25",
            "druid-0.4.24",
            "druid-0.4.23",
            "druid-0.4.22",
            "druid-0.4.21",
            "druid-0.4.20",
            "druid-0.4.19",
            "druid-0.4.18",
            "druid-0.4.17",
            "druid-0.4.16",
            "druid-0.4.15",
            "druid-0.4.12",
            "druid-0.4.11",
            "druid-0.4.10",
            "druid-0.4.9",
            "druid-0.4.8",
            "druid-0.4.7",
            "druid-0.4.6",
            "druid-0.4.5",
            "druid-0.4.3",
            "druid-0.4.2",
            "druid-0.4.1",
            "druid-0.4.0",
            "druid-0.3.34",
            "druid-0.3.33",
            "druid-0.3.32",
            "druid-0.3.27",
            "druid-0.3.31",
            "druid-0.3.30",
            "druid-0.3.29",
            "druid-0.3.28",
            "druid-0.3.25",
            "druid-0.3.24",
            "druid-0.3.22",
            "druid-0.3.21",
            "druid-0.3.20",
            "druid-0.3.18",
            "druid-0.3.16",
            "druid-0.3.15",
            "druid-0.3.14",
            "druid-0.3.13",
            "druid-0.3.12",
            "druid-0.3.11",
            "druid-0.3.10",
            "druid-0.3.6",
            "druid-0.3.5",
            "druid-0.3.4",
            "druid-0.1.14",
            "druid-0.1.13",
            "druid-0.1.12",
            "druid-0.1.11",
            "druid-0.1.10",
            "druid-0.1.9",
            "druid-0.1.8",
            "druid-0.1.7",
            "druid-0.1.6",
            "druid-0.1.4",
            "druid-0.1.3",
            "druid-0.1.2",
            "druid-0.1.1",
            "druid-0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26919.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:49.372584925Z",
      "provider": "osv",
      "references": [
        "https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad%40%3Cdev.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/r470f8c92eb5df45f41b3ae609b6315b6c5ff51b3ceb2f09f00ca620f%40%3Cdev.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/r6bc68264170046448f823d12c17fd1fd875251d97d60869f58709872%40%3Ccommits.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/r7a531ec123570cb7875ff991cf115f99e9ef99a48b3cf3fa4f9d9864%40%3Ccommits.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/ra85fa7d31f9bec1148ffd2e4030934927caa8bff89bca9f61f75e697%40%3Cdev.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/re0910cf4c784897774427fecd95912fb565a6bd06d924a55e70bbbfc%40%3Ccommits.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/re4c5deb0aae4bace69844d15c9fd1699e907ebfee93bc3926474d110%40%3Cdev.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/rf3ea2a4018e87e6c45d36cf8479af7727dcc276edabd2f7cf59e0c5f%40%3Cdev.druid.apache.org%3E",
        "https://lists.apache.org/thread.html/rd87451fce34df54796e66321c40d743a68fb4553d72e7f6f0bc62ebd%40%3Cdev.druid.apache.org%3E"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-26919",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 436979,
  "published_at": "2021-03-30T08:15:11.34+00:00"
}