# GHSA-Q672-HFC7-G833

## Summary

Apache Druid basic security LDAP authenticator can be bypassed when the LDAP server allows anonymous binds, permitting login with any existing username and an empty password.

## Description

## Summary
Apache Druid’s druid-basic-security extension with LDAP authentication is vulnerable to an authentication bypass when the configured LDAP server allows anonymous bind. An attacker can supply any existing username with an empty password and be authenticated.

## Affected Package
- **Package**: `org.apache.druid.extensions:druid-basic-security`
- **Ecosystem**: Maven
- **Vulnerable versions**: >= 0.17.0, < 36.0.0 (all versions prior to 36.0.0)
- **Patched version**: 36.0.0

## Details
When LDAP is used for authentication and the underlying LDAP server permits anonymous binds, Apache Druid improperly treats successful anonymous bind responses as valid authentication. This allows unauthenticated users to bypass login by providing an existing username and an empty password. Impact includes unauthorized access to Druid clusters, sensitive data exposure, query execution, and potential administrative access depending on the account targeted.

## Reproduction Steps
1. **Environment setup**:
   - Deploy Apache Druid version 0.17.0–35.x with the `druid-basic-security` extension enabled.
   - Configure the LDAP authenticator for Druid.
   - Ensure the LDAP server allows anonymous bind.
2. **Exploit**:
   - Attempt to authenticate to Druid using an existing username with an empty password.
3. **Expected vulnerable behavior**:
   - Authentication succeeds and access is granted without valid credentials.

## Indicators of Success
- Successful login/access to Druid resources using an existing username and empty password.
- Ability to run queries or access restricted data without proper credentials.

## Mitigation
- Immediate: Disable anonymous bind on the LDAP server.
- Long-term: Upgrade Apache Druid to 36.0.0 or later.

## References
- https://github.com/advisories/GHSA-Q672-HFC7-G833
- https://nvd.nist.gov/vuln/detail/CVE-2026-23906
- https://lists.apache.org/thread/2x9rv3kv6t1p577lvq4z0rl0zlt9g4sr