CVE-2025-59390
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-12-04
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | druid | to 35.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Apache Druid's Kerberos authenticator uses a weak fallback secret when the configuration 'druid.auth.authenticator.kerberos.cookieSignatureSecret' is not explicitly set. This fallback secret is generated using ThreadLocalRandom, which is not cryptographically secure. As a result, an attacker may be able to predict or brute force the secret used to sign authentication cookies, potentially allowing token forgery or authentication bypass. Additionally, each process generates its own fallback secret, causing inconsistent secrets across nodes and leading to authentication failures in distributed or multi-broker deployments.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to predict or brute force the secret used to sign authentication cookies, which may enable token forgery or authentication bypass. In distributed or multi-broker deployments, inconsistent fallback secrets across nodes can cause authentication failures, effectively leading to incorrectly configured clusters and potential denial of service or unauthorized access.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should explicitly configure a strong value for the 'druid.auth.authenticator.kerberos.cookieSignatureSecret' in your Apache Druid configuration. Additionally, upgrade Apache Druid to version 35.0.0 or later, where setting this secret is mandatory and the issue is fixed. Note that services will fail to start if the secret is not set in the fixed version, ensuring proper configuration.