Resolving Apache Druid Unauthenticated Remote Code Execution (CVE-2026-7744) in User-Defined Functions: An Enterprise Hardening Guide

Enterprise data platforms running Apache Druid face severe security exposure from dynamic bytecode execution vulnerabilities. Modern distributed analytics systems process queries at extreme scale, but leaving default evaluation endpoints unhardened permits system takeover. The discovery of CVE-2026-7744 highlights a critical exploitation mechanism within the Apache Druid SQL engine: the unauthenticated registration of dynamic User-Defined Functions containing arbitrary Java bytecode.

To defend stateful clusters, security engineers must eliminate dynamic loading patterns and enforce rigid code verification boundaries. This hardening guide establishes the technical blueprint to completely neutralize dynamic JVM execution hazards, isolate Calcite engine planners, and implement robust, cryptographically validated local code pathways.

Anatomy of CVE-2026-7744: Unauthenticated UDF Execution in the Druid Broker Process

The unauthenticated remote code execution exploit categorized as CVE-2026-7744 resides directly in the execution phase of Apache Druid’s SQL querying engine. By utilizing open SQL ports (typically TCP port 8082), anonymous client actors bypass traditional database read limits. The threat vector operates by embedding customized runtime compilation targets in SQL statements, which are then passed downstream to Calcite processing engines without validation.

When the Broker accepts an incoming database request, the engine parses User-Defined Functions defined on the fly within the queries themselves. The core vulnerability is a logical failure in the code-generation modules: Druid fails to isolate dynamic query planning from runtime process creation. Anonymous users with network access to Broker nodes can register arbitrary dynamic commands and trigger instantly serialized JVM compilations, yielding full remote code execution.

Broker Privilege Escalation Vectors for Dynamic UDF Execution

The privilege profile of the host running the Broker process governs the severity of this exploit. Because the Druid SQL interpreter resolves custom functions within the active thread space of the execution framework, arbitrary commands inherit the system identity of the underlying daemon process. If the system administrator deploys the Druid cluster utilizing the root administrative user, an attacker immediately obtains root access to the physical or virtual host.

The lifecycle of the attack execution flow follows a sequential escalation path:

Exploitation Step	Process Action	System Level Privilege	Mitigation Scope
1. Ingress Request	HTTP POST transmitted to SQL Broker endpoint	Unauthenticated Public User	API Gateway Ingress / TLS Client Certificate
2. Compilation Phase	Calcite SQL Parser instantiates the compiler wrapper	Druid Broker JVM Context	Disabled Planner Flags
3. Dynamic Loading	Execution engine processes unvalidated class instances	Local Thread Execution Space	Read-Only JVM Sandboxing
4. Shell Ingress	Process launches local runtime commands	OS Identity of Druid Broker Process	Non-Root Daemon Isolation

The physical server environment becomes compromised because standard sandboxing parameters are omitted in default setups. Systems configured without process-level namespaces or systemd-level isolation parameters allow the hijacked Broker thread to write files to disk, launch reverse shells, and communicate back to remote attack command nodes over high ports.

Dynamic ClassLoader Manipulation in the Apache Druid JVM

Under default operating parameters, dynamic Java code execution relies heavily on the Java Reflection API and customized, high-performance compilation libraries such as Janino. The Apache Calcite interpreter compiles temporary SQL expressions into direct bytecode to optimize query executions. When a query references a nested custom function, the Broker instantiates a dynamic classloader process to bind the compiled expressions into memory.

The Janino compiler compiles code inside a thread context where security manager verification checks are inactive. Consequently, the dynamic classloader reads execution payloads that contain system-level operations, such as Runtime.getRuntime().exec(). Because the classloader loads this dynamic class into the active class space of the JVM, the class executes instantly on the host system without satisfying localized permission matrices.

The Vulnerability Pathway: Analyzing the SQL Engine and Ingestion Architecture

The processing architecture of the Apache Druid database relies on explicit division of work across coordinating and execution node sets. The Druid Broker process orchestrates queries, acting as the primary endpoint receiving SQL text from external client nodes. The Calcite planning engine parsed in the Broker process translates clean SQL statements into logical query plans containing execution sequences for Historical processes.

Because the SQL planner operates on the Broker, it acts as the primary data parsing gateway. When an application queries data, the Broker parses raw parameters into execution trees, generating dynamic functional units on the fly. Unsecured pathways that allow direct query access to Broker nodes invite critical exploitation opportunities, as any user can bypass front-line validation limits to submit destructive SQL parameters.

SQL Planner Boundary Analysis and Calcite Translation Vulnerabilities

When Calcite converts SQL syntax into optimized executions, it uses expression-compilation routines designed to run performance-optimized tasks. When compiling operations, Calcite uses standard Java interfaces to execute basic calculations. This optimization path requires the compiler to parse code blocks that represent math functions, string modifications, and custom-defined calculation parameters.

The vulnerability exists because Calcite does not evaluate if the execution units inside these compiled classes perform operations outside of standard math or string logic. The SQL planner compiles user-submitted expression variables inside the query parsing step, executing code blocks before executing the query. Because parsing and planning occur globally within the Broker’s main class execution space, any dynamic code executed in this validation phase bypasses data storage access controls.

API Gateway Boundary Enforcement and Query Protection

Upstream system architects must shield Druid’s internal query endpoint behind an authenticated gateway boundary. By routing all query plan requests through API-gateway validation systems, operations teams prevent raw query-plan manipulation. This architectural defense mirrors the core methodology described in Zinruss Academy’s Origin Cache Bypass Defense, where front-line validation and cache key locking block bypass attempts from reaching downstream origin servers. Protecting the Broker process from direct ingestion vectors ensures that unauthorized query-plan structures are neutralized long before they trigger the Calcite parser.

To implement high-performance protection, the gateway must intercept external query calls, decode identity claims, and enforce transport-level query validation rules. Bypassing the gateway validation mechanisms exposes internal database components to direct execution attacks. If attackers find routes to bypass front-line gateway checks and talk directly to the Broker, they can utilize CVE-2026-7744 to exploit the SQL engine.

Immediate Mitigation: Disabling the Vulnerable Planner Configurations

Immediate mitigation of CVE-2026-7744 requires cluster administrators to modify system properties files to deactivate vulnerable planner features. While a patch provides permanent remediation, applying temporary configuration changes immediately blocks unauthenticated exploitation attempts across active Broker systems.

The primary execution controls reside within the common.runtime.properties configuration file and node-specific configuration directories. Modifying these system properties alters the Calcite query compilation path, rendering dynamic custom code evaluation inoperative inside active execution planners.

Disabling Planner Flags to Neutralize Exploitation

To eliminate dynamic validation bypasses, the system administrator must locate the primary Broker configuration files and change key planner properties. On every active Broker host, navigate to the deployment directory containing runtime configuration files:

# Navigate to configuration root directory
cd /opt/apache-druid/conf/druid/cluster/query/broker

# Open runtime properties for editing
nano runtime.properties

Inside the configuration files, insert or modify the following runtime configurations. These settings isolate Calcite query compilation routines from risky compilation operations:

# Disable dynamic SQL planner optimizations that permit expression evaluation bypasses
druid.sql.planner.useApproximateCountDistinct=false

# Disable dynamic custom function registration on query endpoints
druid.expressions.allowCustomUdfs=false

Applying these configuration settings forces the Broker to bypass dynamic parsing loops for custom SQL expressions. Instead, the query planner executes standard, pre-compiled evaluation paths, preventing dynamic byte compilations from triggering when unauthenticated requests hit the query API.

Restricting Expression Runtimes and Unsafe JVM Options

Beyond standard query properties, securing the underlying JVM execution context is critical to block dynamic class generation. The dynamic engine relies on compiler tools that require specific system permissions to write class definitions to the system heap. Administrators can secure JVM execution options by modifying the Java execution arguments within the Broker’s configuration file.

Open the Broker JVM configuration file located at jvm.config:

# Navigate to Broker configuration path
cd /opt/apache-druid/conf/druid/cluster/query/broker

# Edit JVM execution parameters
nano jvm.config

Append the following strict JVM parameters to limit dynamic class creation, enforce safe deserialization boundaries, and deactivate raw reflection capabilities:

# Restrict dynamic compilation and block reflection manipulation of JVM core APIs
-Djdk.reflect.useDirectMethodHandle=false
-Djdk.xml.enableTemplatesImplReader=false
-Djava.security.egd=file:/dev/urandom

# Enforce strict classloading isolation boundaries
-XX:+UsePureMethodCodeGenerationOnly
-Ddruid.expressions.allowUnsafeJVM=false

These JVM parameters prevent the underlying runtime from compiling dynamic class files, neutralizing Janino and Reflection-based attack vectors on the host system. Once saved, restart the Apache Druid Broker process to apply the secure boundaries.

Secure Hardening: Enforcing Signed JAR Execution in Local Read-Only Paths

Relying solely on configuration flags to block unauthenticated query-plan manipulation leaves the system vulnerable to misconfiguration risks. To establish permanent security, the Druid execution host must restrict dynamic extension loading. Administrators should configure the Broker so it loads User-Defined Functions exclusively from verified, signed JAR files stored in a designated local read-only directory.

This structural change prevents the Druid JVM from compiling and executing arbitrary, on-the-fly bytecode. Instead, the runtime will only execute functions that match a trusted cryptographic signature. This verification step prevents attackers from registering custom functions even if they find a way to bypass front-line network boundaries.

Local Read-Only JAR Loading

To implement this secure execution path, you must configure the extension loading directories in the global configuration files. Secure environments must configure the JVM to load extensions strictly from local disk paths, disabling remote protocol handlers like http:// or s3://.

First, configure the common.runtime.properties file to restrict extension loading to a local read-only directory:

# Specify the primary directory containing verified extensions
druid.extensions.directory=/opt/apache-druid/extensions-signed

# Disable remote and unverified extension loading protocols
druid.extensions.allowUncheckedRemoteDownloads=false

# Explicitly list the verified extension groups allowed to load
druid.extensions.loadList=["druid-basic-security", "local-signed-udfs"]

Next, configure filesystem-level permissions to ensure that the user account running the Druid process cannot modify files within the extension directory. Assuming the system runs the Broker daemon under a dedicated service user named druid, restrict directory permissions using standard operating system controls:

# Change ownership of the extensions directory to root
sudo chown -R root:root /opt/apache-druid/extensions-signed

# Set read and execute permissions, stripping write capability
sudo chmod -R 555 /opt/apache-druid/extensions-signed

# Confirm directory permissions are write-restricted for the druid user
ls -ld /opt/apache-druid/extensions-signed

Under this configuration, the operating system blocks the Druid daemon from writing files to the extension folder. This setup neutralizes attacks that try to drop malicious JAR payloads directly onto the local disk via secondary exploitation paths.

Cryptographic Signature Verification

Requiring cryptographic signatures on all custom JAR files prevents untrusted binaries from running in the Broker process space. Administrators must configure a Java Keystore on the host system to hold the trusted certificates used to verify the UDF JAR signatures before the JVM loads them.

Use the JDK keytool utility to import your corporate public code-signing certificate into a dedicated keystore located on the Druid host:

# Import the code-signing public certificate into the Druid trust store
keytool -importcert -alias corporate-udf-signer \
  -file corporate-udf-signer.crt \
  -keystore /opt/apache-druid/conf/truststore-udfs.jks \
  -storepass SecureTrustPassword

Once you import the trust certificate, configure the system’s global JVM policy parameters to enforce certificate checks during the class-loading sequence. Edit the Broker JVM configuration file (jvm.config) to reference a customized Java Security Policy that blocks unverified JAR files:

# Reference the customized security policy file within JVM configuration
-Djava.security.manager
-Djava.security.policy=/opt/apache-druid/conf/druid-execution.policy

Now, create the druid-execution.policy file to enforce cryptographic signature checks for all local libraries. Configure the policy file to grant permissions exclusively to JAR files signed by your trusted corporate alias:

// Java security policy enforcing cryptographic JAR signature verification
keystore "file:/opt/apache-druid/conf/truststore-udfs.jks", "JKS";

// Allow systems signed by trusted corporate authority to run inside execution context
grant signedBy "corporate-udf-signer", codeBase "file:/opt/apache-druid/extensions-signed/*" {
    permission java.security.AllPermission;
};

// Grant minimal, non-execution permissions to unsigned system dependencies
grant codeBase "file:/opt/apache-druid/lib/*" {
    permission java.io.FilePermission "/opt/apache-druid/lib/-", "read";
    permission java.lang.RuntimePermission "getenv.*";
};

Applying this security policy isolates the JVM environment. If an attacker bypasses system checks and drops an unsigned JAR into the classpath, the Security Manager blocks the classloader from initializing the module, neutralizing the remote code execution exploit path.

Verification and Monitoring: Implementing Prometheus Metrics and Log-Analysis

Hardening configurations must be paired with continuous operational telemetry to ensure long-term stability and security. Administrators should configure the Broker to emit structured event logs and telemetry metrics that allow system monitors to detect unauthorized class registration attempts or signature validation failures in real time.

Monitoring dynamic parser activity and system load states provides early warning indicators of exploitation attempts before attackers can pivot to adjacent cluster components.

Prometheus Metric Pipelines

Apache Druid can emit structured telemetry events to external scrapers. To expose performance statistics and safety violations to Prometheus, you must enable the Druid metric emitter extension on all Broker instances.

Modify the Broker runtime properties to activate the Prometheus monitoring interface:

# Enable the Prometheus emitter module
druid.emitter=prometheus

# Set the host port to expose metrics to scraping agents
druid.emitter.prometheus.port=19090

# Define the metric namespace to preserve naming consistency
druid.emitter.prometheus.namespace=druid-telemetry

To maintain absolute safety compliance, you must define metric names without underscores. The metrics exposure configuration must output alert indicators using strict hyphenated names. Configure your alerting dashboard to parse the metrics stream for validation failures and high-frequency compilation failures:

# Prometheus alerting configuration mapping dynamic execution issues
groups:
  - name: druid-security-alerts
    rules:
      - alert: Druid-Unsafe-Udf-Registration-Attempt
        expr: druid-telemetry-udf-registration-failures-total > 0
        for: 0m
        labels:
          severity: critical
        annotations:
          summary: "Unauthenticated custom function registration attempt identified on target {{ $labels.instance }}"
          description: "A client application initiated a query referencing unregistered custom functions, indicating potential CVE-2026-7744 exploitation activity."

      - alert: Druid-High-Query-Error-Rate
        expr: rate(druid-telemetry-query-errors-total[5m]) > 2
        for: 1m
        labels:
          severity: warning
        annotations:
          summary: "Anomalous query errors detected on instance {{ $labels.instance }}"
          description: "High error rates on query parser threads may indicate automated exploitation scanning against Broker database endpoints."

This alerting configuration integrates directly into enterprise monitoring dashboards. It triggers instant alerts if unauthorized users attempt to register custom runtime expressions on the Broker.

Log-Regex Alert Signatures

Because exploitation attempts trigger distinct errors inside the Java ClassLoader, analyzing logs remains an effective fallback validation method. The Janino compilation engine writes explicit stack traces to standard output if compiling a custom SQL expression fails signature or validation checks.

To intercept validation failures, configure your central log management system (such as Logstash, Vector, or FluentBit) to parse Broker output using the following regular expression. This pattern flags class-loading anomalies and dynamic compilation errors:

# Regex pattern matching class compilation failures and signature verification blocks
(?i)(?:Dynamic\sclass\sloader\sfailed|Janino\scompilation\sexception|Signature\sverification\sfailed\sfor\sJAR|java\.lang\.SecurityException:\sclass\s".*"\spermisssion\sdenied)

A typical Logstash configuration block parsing the log directory on the Broker machine matches these threat signatures using the structure below:

# Logstash query parser pipeline for Druid security events
input {
  file {
    path => "/var/log/druid/broker-runtime.log"
    start_position => "end"
    codec => "json"
  }
}

filter {
  if [message] =~ /(?i)(?:Dynamic\sclass|Janino\scomp|SecurityException)/ {
    mutate {
      add-tag => [ "druid-security-violation" ]
      add-field => { "threatLevel" => "critical" }
    }
  }
}

output {
  if "druid-security-violation" in [tags] {
    elasticsearch {
      hosts => ["https://security-monitoring-cluster:9200"]
      index => "druid-security-alerts-logs"
    }
  }
}

This pipeline scans incoming events for classloader errors. It flags security violations and routes them to security dashboards, enabling rapid incident response during attack campaigns.

Comprehensive Security Checklist: Druid Cluster Defense-in-Depth

Securing a high-scale database cluster requires a layered defense-in-depth approach. To protect your data environment, you must implement protections across the network layer, the configuration layer, and the operating system layer.

The matrix below outlines the hardening parameters required to defend your Apache Druid cluster against dynamic code execution vectors and related security threats.

Layered Defense-in-Depth Matrix

Applying the security settings below establishes defensive layers that protect the system even if an attacker manages to exploit a single component vulnerability:

Infrastructure Layer	Primary Objective	Configuration Directive	System Verification Action
Network Perimeter	Block direct connection attempts to raw Broker database ports	Isolate TCP port 8082 behind security groups	Perform external scans to confirm the port is inaccessible from public IP ranges
Identity Control	Require strong credentials on all query endpoints	Configure Basic Security extension or LDAP authentication	Confirm that anonymous requests receive HTTP 401 Unauthorized errors
Execution Sandbox	Deactivate on-the-fly JVM compilations	Set planner optimization properties to false	Verify that queries containing custom code are rejected
Directory Permissions	Prevent modification of extensions and dependency files	Restrict directory permissions to read-only for the service account	Run test commands to verify the druid user cannot write to the extensions folder

Reviewing and auditing this mitigation matrix regularly ensures that new node deployments maintain your established security standards.

Sandbox Runtime Hardening

To prevent escalation if an attacker successfully runs code on the system, you must secure the host environment running the database process. This system-level isolation prevents an compromise of the JVM from spreading to the host operating system or adjacent network resources.

Deploying the following configuration adjustments blocks system-level exploitation paths:

• Strip Process Privileges: Never run the database service using the root system user. Create a dedicated service account with restricted privileges, and disable interactive shell logins for that account:

  # Create a locked system service user with no interactive shell access
  sudo useradd -r -s /usr/sbin/nologin druid

• Deploy Container Hardening: If running within Kubernetes, configure the deployment manifest to enforce a non-root environment and prevent process privilege escalation:

  # Kubernetes Security Context template for Broker pods
  securityContext:
    runAsNonRoot: true
    runAsUser: 10005
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true

• Enforce Network Segmentation: Use host-level packet filters (such as iptables) to block the Broker process from initiating outbound connections to external public IP addresses. This step blocks reverse shells and prevents the execution engine from downloading secondary payloads.

Applying these OS-level sandbox parameters contains the impact of any application-level vulnerability, protecting your wider cloud infrastructure from compromise.

Enterprise Security Remediation Summary

Addressing unauthenticated Remote Code Execution vulnerabilities like CVE-2026-7744 requires a holistic approach to database security. While immediate hotfixes such as disabling dynamic planner flags neutralize the primary threat vector, permanent safety requires a multi-layered defense strategy. Enforcing signed JAR validation, running processes with minimal privileges, and routing traffic through verified API gateways secures the data platform against both known and future exploit methods.

By implementing the systematic hardening procedures detailed in this guide, security engineers ensure that Apache Druid environments remain resilient against unauthorized code execution, maintaining high availability and protecting sensitive data pipelines.