CVE-2021-25646: Apache Druid JavaScript execution bypass enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote code execution with low attack complexity, high EPSS and public exploit code, though it requires an authenticated account.

What it is

Apache Druid supports executing user-provided JavaScript embedded in requests, a feature intended for high-trust environments and disabled by default. In Druid 0.20.0 and earlier, an authenticated user can send a specially-crafted request that forces Druid to run that JavaScript regardless of server configuration. Because the code runs with the privileges of the Druid server process, this is a full remote code execution flaw.

Impact

An attacker with a valid Druid account gains arbitrary code execution on the Druid host under the server process account, allowing data theft, lateral movement and full host compromise.

Attack surface

Reached over the network via the Druid HTTP interface (CVSS vector AV:N); the attacker must be authenticated (PR:L) and no user interaction is required (UI:N).

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.99001, 99.9th percentile) and public references are tagged Exploit, indicating working exploit code is available.

What to do

• Upgrade Apache Druid to a version later than 0.20.0 that fixes the JavaScript execution bypass.
• If immediate upgrade is not possible, restrict network access to Druid's HTTP endpoints to trusted hosts only.
• Audit and remove or tightly control Druid accounts, since exploitation requires authentication.
• Run the Druid process with a least-privilege service account to limit post-exploitation impact.
• Monitor for and block requests containing embedded JavaScript payloads where feasible.

Detection

• Inspect Druid HTTP request logs for requests containing JavaScript code or suspicious function calls in query fields.
• Alert on unexpected child processes or outbound connections spawned by the Druid server process.
• Monitor for anomalous file writes or command execution originating from the Druid host.
• Correlate Druid authentication events with subsequent unusual query activity from the same account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.