CVE-2021-25646

High PUBLISHED

Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

Apache Software Foundation · Apache Druid

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

8.8 High

At a Glance

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

metasploit nuclei_scanner java apache

CVE Published: Jan 29, 2021
Exploitation Reported: Apr 27, 2025
CVSS: 8.8 High
EPSS: —

Remote Low complexity No user interaction

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache Druid	0.20.0 and earlier to <= 0.20.0	Affected

CVE References

[oss-security] 20210129 CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/01/29/6
[druid-dev] 20210129 Re: [druid-user] Re: CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. lists.apache.org · Mailing List https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7af...
[druid-dev] 20210129 Re: CVE-2021-25646: Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. lists.apache.org · Mailing List https://lists.apache.org/thread.html/rc167d5e57f3120578718a7a458ce3e7...
[announce] 20210129 Subject: [CVE-2021-25646] Apache Druid remote code execution vulnerability lists.apache.org · Mailing List https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c...
[druid-commits] 20210204 [GitHub] [druid] jihoonson merged pull request #10818: Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r4f84b542417ea46202867c0a8b3eaf3...

Show 11 more references

[druid-commits] 20210204 [GitHub] [druid] jihoonson commented on pull request #10818: Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/rea9436a4063927a567d698431ddae55...
[druid-commits] 20210204 [GitHub] [druid] jihoonson opened a new pull request #10854: [Backport] Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r121abe8014d381943b63c60615149d4...
[druid-commits] 20210204 [druid] branch 0.21.0 updated: Fix CVE-2021-25646 (#10818) (#10854) lists.apache.org · Mailing List https://lists.apache.org/thread.html/rfeb775822cd3baef1595b60f6860f5c...
[druid-commits] 20210204 [GitHub] [druid] jihoonson merged pull request #10854: [Backport] Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r04fa1ba93599487c95a8497044d37f8...
[druid-commits] 20210205 [GitHub] [druid] jihoonson opened a new pull request #10854: [Backport] Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r87aa94e28dd21ee2252d30c63f01ab9...
[druid-commits] 20210205 [GitHub] [druid] jihoonson merged pull request #10818: Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r7dff4790e7a5c697fc0360adf11f5ae...
[druid-commits] 20210205 [GitHub] [druid] jihoonson commented on pull request #10818: Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/ra4225912f501016bc5e0ac44e14b8d6...
[druid-commits] 20210205 [GitHub] [druid] jihoonson merged pull request #10854: [Backport] Fix CVE-2021-25646 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r5ef625076982aee7d23c23f07717e62...
[druid-dev] 20210331 Regarding the 0.21.0 release lists.apache.org · Mailing List https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc072932...
Apache Mailing List lists.apache.org · CVE Record https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f...
packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Comm... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remot...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2025-04-28 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25646.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_druid_js_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 9.0 High

AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2025-04-27 00:00:00 UTC · The Shadowserver

Proof of concept available

Recorded 2021-12-12 14:40:12 UTC · GitHub

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_druid_js_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25646.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

k7pro/CVE-2021-25646-exp

github · Created 2024-10-04 15:06:37 UTC · 4 stars

CVE-2021-25646 Apache Druid 远程代码执行漏洞检测和利用工具

j2ekim/CVE-2021-25646

github · Created 2021-12-12 14:40:12 UTC · 4 stars

Apache Druid remote code execution vulnerability - Apache Druid 远程代码执行漏洞利用 CVE-2021-25646

givemefivw/CVE-2021-25646

github · Created 2021-04-14 15:36:04 UTC · 3 stars

CVE-2021-25646 Apache Druid 远程代码执行漏洞 Wker脚本

Vulnmachines/Apache-Druid-CVE-2021-25646

github · Created 2021-02-13 11:48:35 UTC · 3 stars

lp008/CVE-2021-25646

github · Created 2021-02-03 06:45:54 UTC · 2 stars

Apache Druid - Remote Code Execution

nuclei · Created Unknown

apache_druid_js_rce

metasploit · Created Unknown

Metasploit module for CVE-2021-25646

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-25646

{
  "cve_id": "CVE-2021-25646",
  "title": "Authenticated users can override system configurations in their requests whic...",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache Druid",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 8.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-25646

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API