GHSA-w88f-4875-99c8
Critical · 9.8CVSS
9.8
EPSS
—
Published
Nov 26, 2025
CISA due date
—
The record
Apache Druid’s Kerberos authenticator uses a weak fallback secret
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.druid:druid | 0 | 35.0.0 |
Related vulnerabilities
- CVE-2025-59390 Apache Druid’s Kerberos authenticator uses a weak fallback secret Same vulnerability
- CVE-2026-74887 openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne… CWE-338
- CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. CWE-338
- CVE-2026-16615 A flaw was found in librest. CWE-338
- CVE-2026-14495 The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via… CWE-338
- CVE-2026-7830 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication… CWE-338
- CVE-2026-44040 UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to… CWE-338
- CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure… CWE-338