Overview
Apache Druid is a real-time analytics database. Its management proxy forwards web console requests to other Druid services and is on by default. A crafted URL makes the proxy send the request to a server of the attacker's choosing instead.
An authenticated user turns that into server-side request forgery against internal hosts, cross-site scripting in the console, or an open redirect. Druid 31.0.2 and 32.0.1 fix the issue. Disabling the management proxy also closes it, at the cost of some console features.
Affected products
- Apache Druid before 31.0.2
- Apache Druid 32.0.0
Disclosure timeline
- 19 Mar 2025
- Apache releases Druid 31.0.2 and 32.0.1 with the fix; advisory posted to oss-security
- 20 Mar 2025
- CVE-2025-27888 published
- 23 Sep 2025
- XBOW publishes the technical write-up