Apache Software Foundation Ranger vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Apache Software Foundation Ranger: 12 record(s), with affected versions and fixes.cpe:2.3:a:apache:ranger
CVE-2026-65948
High · 7.3
CWE-307 Aug 10, 2026
Apache Ranger: UnixAuth lacks brute-force protection
UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.
Note: UnixAuth is NOT a recommended option for production deployments.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-65945
Medium · 6.5
CWE-532 Aug 10, 2026
Apache Ranger: Logs contain replayable JWT bearer tokens
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-65942
High · 7.5
CWE-297 Aug 10, 2026
Apache Ranger: Clients accept TLS certificates issued for other hostnames
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-55814
High · 7.5
CWE-306 Aug 10, 2026
Missing Authentication for Critical Function in Apache Software Foundation Ranger
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-55799
Critical · 9.8
CWE-94 Aug 10, 2026
Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-44416
Critical · 9.8
CWE-94 Aug 10, 2026
Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-42537
Critical · 9.8
CWE-20 Aug 10, 2026
Apache Ranger: Remote Code Execution via JDBC URL Injection
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-40920
Critical · 9.8
CWE-20 Aug 10, 2026
Apache Ranger: Privilege Escalation via URL Parameter
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-32227
Critical · 9.8
CWE-89 Aug 10, 2026
Apache Ranger: SQL Injection vulnerability in lookup functionality
SQL Injection vulnerability vulnerability in Apache Ranger.
This issue affects .
Users are recommended to upgrade to version 2.9.0, which fixes the issue.
CVE-2026-28672
Critical · 9.8
CWE-77 Aug 10, 2026
Command Injection in Apache Software Foundation Ranger
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.
This issue affects Apache Ranger: from 0.6 through 2.8.
CVE-2025-59060
Medium · 5.3
CWE-297 Mar 3, 2026
Apache Ranger: Hostname verification bypass in NiFiRegistryClient
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
CVE-2025-59059
Critical · 9.8
CWE-94 Mar 3, 2026
Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.