What is CVE-2025-59390?

CVE-2025-59390 is a critical-severity vulnerability in Apache Druid, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 9.8/10. Published 2025-11-26.

How severe is CVE-2025-59390?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2025-59390 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Druid

CVE-2025-59390

Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret` This issue affects Apache Druid: through 34.0.0. Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set.

EPSS: 0.006 (47.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Druid
Apache Software Foundation Druid — versions 0

Weakness classification (CWE)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Public proof-of-concept exploits

Daeda1usUK/CVE-2025-59390-

References

security@apache.org (vendor-advisory, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2025-59390?: CVE-2025-59390 is a critical-severity vulnerability in Apache Druid, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 9.8/10. Published 2025-11-26.
How severe is CVE-2025-59390?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2025-59390 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.