Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/druid

              master @ 9318bbe
            

151

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 50 prior fixes. Scrutinize any change in this area.

pom.xml: most-fixed (36 issues). Treat as high-risk during review.

105 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Numerous fixes show authentication checks being skipped, null authorizers granting access, missing 401 responses, and OPTIONS/unsecured path bypasses. The attack surface is broad and frequently patched, indicating systemic risk in filter ordering and request attribute handling.

Auth Bypass: SQL layer has multiple authorization bypass fixes: unauthorized tables/views in schema, missing EXTERNAL resource type registration, insufficient permissions on system tables, and INSERT without WRITE checks. The planner and schema providers are complex and have been repeatedly patched.

Auth Bypass: Multiple fixes address missing or incorrect authorization on supervisor listing, history, bulk operations, and task submission. The pattern of READ vs WRITE permission confusion and unfiltered responses indicates recurring gaps in resource-level authorization.