The vulnerability in Apache Druid arises when the druid-basic-security extension is used with LDAP authentication and the underlying LDAP server permits anonymous binds. The LDAP authenticator incorrectly validates authentication responses, treating a successful anonymous bind as a valid user authentication. This flaw allows a remote, unauthenticated attacker to supply any existing username with an empty password and gain authenticated access to the Druid cluster, thereby enabling unauthorized read, query, or administrative actions on data stored in Druid datasources.

Affected systems include Apache Druid releases from version 0.17.0 through 35.x, all of which lack the proper rejection of anonymous LDAP bind attempts. The vulnerability is only present when the druid-basic-security extension is enabled, an LDAP authenticator is configured, and the LDAP server accepts anonymous binds.

The CVSS score of 9.8 reflects a high‑impact remote exploitation scenario. Although the EPSS score is below 1%, indicating a low current exploitation probability, the issue is not listed in the CISA KEV catalog. The attack vector is remote; an attacker must be able to reach the Druid service and trigger the LDAP authentication workflow. By exploiting the permissive anonymous bind, the attacker can bypass authentication and attain full access to the cluster without valid credentials.