CVE-2021-25646 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected**: **Apache Druid**. 📅 **Versions**: **0.20.0 and earlier**. 🏢 **Vendor**: Apache Software Foundation.

Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: **Server Process Privileges** (Root/Admin level). 📂 **Data**: Full control over the server, arbitrary code execution, potential data exfiltration or system compromise.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: **YES**. 📜 **PoCs**: Multiple Python scripts, C# GUI tools, and HTTP POST payloads available on GitHub (e.g., `cve-2021-25646.py`). 🌐 **Wild Exp**: Active exploitation tools exist.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Use Python PoC scripts (e.g., `python3 cve-2021-25646.py -h <target>`). 2. Check for **DNSLog** callbacks. 3. Scan for default ports (e.g., **8888**) and Druid console titles.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: **YES**. 🛠️ **Patch**: Released in **Druid 0.21.0**. 📢 **Source**: Apache mailing lists confirm fix in branch 0.21.0.

Updated May 06, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Apache Druid **Access Control Error** allowing arbitrary code execution.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **Access Control Error** (Bypass). <br>🔍 **Flaw**: Lack of proper authorization checks allows overriding system configurations via requests.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected**: **Apache Druid**. <br>📅 **Versions**: **0.20.0 and earlier**. <br>🏢 **Vendor**: Apache Software Foundation.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: **Server Process Privileges** (Root/Admin level). <br>📂 **Data**: Full control over the server, arbitrary code execution, potential data exfiltration or system compromise.

Q5Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: **Medium**. <br>🔑 **Auth**: Requires **Authentication** (though default configs may lack it, the vuln specifically mentions 'authenticated users').…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp**: **YES**. <br>📜 **PoCs**: Multiple Python scripts, C# GUI tools, and HTTP POST payloads available on GitHub (e.g., `cve-2021-25646.py`). <br>🌐 **Wild Exp**: Active exploitation tools exist.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Use Python PoC scripts (e.g., `python3 cve-2021-25646.py -h <target>`). <br>2. Check for **DNSLog** callbacks. <br>3. Scan for default ports (e.g., **8888**) and Druid console titles.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: **YES**. <br>🛠️ **Patch**: Released in **Druid 0.21.0**. <br>📢 **Source**: Apache mailing lists confirm fix in branch 0.21.0.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. **Restrict Access**: Block port 8888 via firewall/WAF. <br>2. **Enable Auth**: Ensure strict authentication is enabled (if possible in older versions). <br>3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. <br>📉 **Priority**: **Critical**. <br>💡 **Reason**: RCE with high privileges, public PoCs available, and many legacy systems still on 0.20.0 or earlier.…

Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) Apache Software Foundation