Apache Ranger vulnerabilities

Latest Apache Ranger CVEs

Newest publication first

1. CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

   Published 2026-08-10

   Critical·CVSS 9.8

   Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

2. CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality

   Published 2026-08-10

   Critical·CVSS 9.8

   SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue.

3. CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter

   Published 2026-08-10

   Critical·CVSS 9.8

   Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

4. CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection

   Published 2026-08-10

   Critical·CVSS 9.8

   Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

5. CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

   Published 2026-08-10

   Critical·CVSS 9.8

   Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

6. CVE-2026-55799 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator

   Published 2026-08-10

   Critical·CVSS 9.8

   Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

7. CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication

   Published 2026-08-10

   High·CVSS 7.5

   Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

8. CVE-2026-65942 Apache Ranger: Clients accept TLS certificates issued for other hostnames

   Published 2026-08-10

   High·CVSS 7.5

   TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

9. CVE-2026-65945 Apache Ranger: Logs contain replayable JWT bearer tokens

   Published 2026-08-10

   Medium·CVSS 6.5

   Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

10. CVE-2026-65948 Apache Ranger: UnixAuth lacks brute-force protection

    Published 2026-08-10

    High·CVSS 7.3

    UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

11. CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions

    Published 2023-05-05

    High·CVSS 8.4

    Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.