CVE-2021-36749
MediumExploitedDruid ingestion system Authenticated users can read data from other sources than intended
Published Sep 27, 2021 · Updated Jul 9, 2026 · Also known as GHSA-9p5g-vg43-mj5r
Key Facts
Patch immediately- CVE-2021-36749 is a medium-severity vulnerability (CVSS 6.5 v3.1) affecting Druid (Apache), org.apache.druid:druid-core (maven).
- It is exploited in the wild, listed in Industry KEV feed since Mar 20, 2022. No public exploit code is known.
- EPSS estimates a 81% probability of exploitation in the next 30 days.
- Fixed versions are available, including Druid 0.22.0, org.apache.druid:druid-core 0.22.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
81%
Higher than 99.6% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing
Public exploit code
None known
Get the full CVE-2021-36749 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Mar 20, 2022 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DruidApache | >= 0.21.1 and earlier | 0.22.0 |
| org.apache.druid:druid-coremaven | See advisory | 0.22.0 |
Patched Releases
Druid
0.22.0
org.apache.druid:druid-core
0.22.0
Timeline
Publicly disclosed
Sep 27, 2021
Added to Industry KEV feed
Mar 20, 2022
Last updated
Jul 9, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-668 Exposure of Resource to Wrong Sphere
- CWE-863 Incorrect Authorization
References
- advisoryhttps://github.com/advisories/GHSA-793h-6f7r-6qvm
- advisoryGHSA advisory
- advisoryhttps://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3E
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2021-36749
- exploitVulnCheck exploitation report
FAQ
Common Questions.
In the Druid ingestion system, the InputSource is used for reading data from a certain data source.
Affected: Druid (Apache) versions >= 0.21.1 and earlier; org.apache.druid:druid-core (maven). The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Mar 20, 2022.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Druid 0.22.0, org.apache.druid:druid-core 0.22.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2021-36749 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo