Exploit for Apache-Druid

kitploit · 2026-08-25

Description

Apache Druid CVE-2021-25646 vulnerability with a YouTube video and tools.

Entry point

Parametertype · request body

Path/druid/indexer/v1/sampler

Authenticated attackers can craft a request to enable and execute JavaScript code on the Druid server via the /druid/indexer/v1/sampler endpoint.

Affected Apache Druid versions

Apache Druid≤ 0.20.0

All known vulnerabilities by product

CVSS 9.0 for CVE-2021-25646

9.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Exploit Details

Modified:2026-08-25 04:17

Last Seen:2026-08-26 00:56

Reporter:KitPloit

Tags

Apache DruidCVE-2021-25646vulnerabilitytoolsYouTube video

Other exploits for CVE-2021-25646

RCE-PoC-CVE-2021-25646

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2021-25646-exp

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2021-25646-GUI

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

Exploit Code

MARKDOWN6 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-VULNMACHINES-APACHE-DRUID-CVE-2021-25646
# Apache-Druid-CVE-2021-25646

## Youtube

https://www.youtube.com/watch?v=-mdK5HSRiQU