A vulnerability classified as critical was found in Apache Druid up to 35.x. The impacted element is an unknown function of the component LDAP Handler. Such manipulation leads to improper authentication.
This vulnerability is traded as CVE-2026-23906. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
