Skip to content

CVE-2026-23906: Verified Repro With Script Download

CVE-2026-23906: Apache Druid basic security LDAP authenticator can be bypassed when the LDAP server allows anonymous binds, permitting login with any existing username and an empty password.

Download script Open in Codespaces

CVE-2026-23906 is verified against org.apache.druid.extensions:druid-basic-security · Maven. Affected versions: 0.17.0 through 35.x (<36.0.0). Fixed in 36.0.0. This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00087.

REPRO-2026-00087 org.apache.druid.extensions:druid-basic-security · Maven Feb 13, 2026 CVE entry ↗ .txt
Severity
CRITICAL
CVSS
9.8
Reproduced in
48m 55s
Tool calls
340
01 · Overview

What Is CVE-2026-23906?

CVE-2026-23906 is a critical authentication bypass in Apache Druid's basic-security extension: the LDAP authenticator can be bypassed when the backing LDAP server allows anonymous binds, letting an attacker log in as any existing username with an empty password. Pruva reproduced it (reproduction REPRO-2026-00087).

02 · Severity & CVSS

CVE-2026-23906 Severity & CVSS Score

CVE-2026-23906 is rated critical severity, with a CVSS base score of 9.8 out of 10.

CRITICAL threat level
9.8 / 10 CVSS base
Weakness CWE-287 — Improper Authentication

Critical — the most severe class — typically remotely exploitable with severe impact. Treat as an emergency.

03 · Affected Versions

Affected org.apache.druid.extensions:druid-basic-security Versions

org.apache.druid.extensions:druid-basic-security · Maven versions 0.17.0 through 35.x (<36.0.0) are affected.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2026-23906

$ pruva-verify REPRO-2026-00087
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00087/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-23906

Reproduced by Pruva's autonomous agents — 340 tool calls over 49 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 426 events · 340 tool calls · 49 min
49 minDuration
340Tool calls
79Reasoning steps
426Events
3Dead-ends
Agent activity over 49 min
Support
6
Repro
309
Variant
107
0:0048:55

Root Cause and Exploit Chain for CVE-2026-23906

Summary

Apache Druid’s druid-basic-security LDAP authenticator accepts a successful LDAP bind as proof of authentication without verifying that a password was actually supplied. If the backing LDAP server allows simple binds with an empty password (anonymous bind with DN), any existing username can be authenticated by providing an empty password.

Impact

  • Package/component affected: org.apache.druid.extensions:druid-basic-security (LDAPCredentialsValidator)
  • Affected versions: >= 0.17.0, < 36.0.0 (verified on 35.0.0)
  • Risk level: High – attackers can authenticate as any existing LDAP user with an empty password when the LDAP server allows anonymous bind, leading to unauthorized access to Druid APIs and data.

Root Cause

LDAPCredentialsValidator#validateCredentials looks up the user DN using the configured bind user, then calls validatePassword() which performs a simple LDAP bind with the supplied password. The code treats any successful bind as valid credentials, but does not explicitly reject empty passwords. On LDAP servers configured to accept simple binds with an empty password (anonymous bind with DN), the bind succeeds and authentication is granted. The patched release (36.0.0) adds explicit checks to reject empty passwords before attempting LDAP bind.

Reproduction Steps

  1. Run repro/reproduction_steps.sh.
  2. The script builds Druid 35.0.0, launches an in-memory LDAP server that accepts empty-password binds, then runs a Java PoC calling LDAPCredentialsValidator with username alice and an empty password.
  3. Expected evidence: the script prints AUTH_SUCCEEDED: alice and Vulnerability reproduced: LDAP anonymous bind accepted empty password.

Evidence

  • Log file: logs/poc_output.txt
  • Key excerpt:
    • AUTH_SUCCEEDED: alice
    • Vulnerability reproduced: LDAP anonymous bind accepted empty password
  • Environment: OpenJDK 17, Maven build of Druid 35.0.0 with UnboundID in-memory LDAP server.

Recommendations / Next Steps

  • Add explicit validation to reject empty passwords before attempting LDAP bind (as done in 36.0.0).
  • Upgrade to Apache Druid 36.0.0 or later.
  • Add regression tests to ensure empty passwords are rejected even if LDAP accepts anonymous binds.

Additional Notes

  • The reproduction script is idempotent and verified to pass twice consecutively.
  • The PoC uses a real LDAP server (UnboundID in-memory) configured to allow empty-password binds, matching the vulnerable behavior scenario.

CVE-2026-23906 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:002:33
0:00
session startedgpt-4o · GHSA-Q672-HFC7-G833 · 71ed9bcc
0:06
0:08
0:12
web search
0:22
0:22
extract_facts
no facts extracted
0:23
0:23
supportrepro
0:37
0:37
0:37
0:44
0:44
0:50
$git clone --depth 1 --branch 35.0.0 https://github.com/apache/druid.git /data/pruva/runs/71ed9bcc-5230-44e4-895f-c399267f95e2/druid
5.7s✓
Cloning into '/data/pruva/runs/71ed9bcc-5230-44e4-895f-c399267f95e2/druid'...
0:51
0:51
0:53
0:54
0:55
0:57
0:58
1:00
1:02
1:04
1:06
1:08
1:12
1:13
1:18
1:18
1:25
1:25
1:28
1:29
1:31
1:32
1:47
1:47
1:47
2:33

Artifacts and Evidence for CVE-2026-23906

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available
08 · How to Fix

How to Fix CVE-2026-23906

Upgrade org.apache.druid.extensions:druid-basic-security · Maven to 36.0.0 or later.

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2026-23906 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2026-23906

How does the Druid LDAP authentication-bypass attack work?

When the backing LDAP server is configured to accept simple binds with an empty password (an anonymous bind with a DN), supplying any existing username together with an empty password causes the bind to succeed, and druid-basic-security accepts that successful bind as proof of authentication - granting access as that user without knowing their real password.

Which Apache Druid versions are affected by CVE-2026-23906, and where is it fixed?

org.apache.druid.extensions:druid-basic-security versions >= 0.17.0 and < 36.0.0 (verified on 35.0.0) are affected; it is fixed in 36.0.0, which adds explicit checks to reject empty passwords before attempting the LDAP bind.

How severe is CVE-2026-23906?

It is rated critical severity - an attacker can authenticate as any existing LDAP user with an empty password, granting unauthorized access to Druid APIs and data, whenever the backing LDAP server permits anonymous binds.

How can I reproduce CVE-2026-23906?

Download the verified script from this page and run it in an isolated environment; it builds Druid 35.0.0, launches an in-memory LDAP server that accepts empty-password binds, and calls LDAPCredentialsValidator with username "alice" and an empty password to show authentication succeeding, then confirms 36.0.0 rejects it.
11 · References

References for CVE-2026-23906

Authoritative sources for CVE-2026-23906 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.