Read the docs
TI-2021-17404 Aliases CVE-2021-40331GHSA-vjr2-wpfh-5r9p

Permissions problem in the Apache Ranger Hive Plugin

Priority LOW 39CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00918 60th percentileScored 2026-11-07
Fix Fixed org.apache.ranger:ranger-hive-plugin (Maven): 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Ranger Hive Plugin2.0.0 – 2.3.0—No fix listedCNA
—org.apache.ranger:ranger-hive-plugin (Maven)2.0.0 to before 2.4.02.4.0Patch availableGHSA-vjr2-wpfh-5r9p
  • Apache Ranger Hive Plugin VendorApache Affected 2.0.0 – 2.3.0 Fixed in — No fix listed CNA
  • org.apache.ranger:ranger-hive-plugin (Maven) Vendor— Affected 2.0.0 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-vjr2-wpfh-5r9p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:ranger:*:*:*:*:*:hive:*:*2.0.0 – 2.3.0VulnerableApache
  • cpe:2.3:a:apache:ranger:*:*:*:*:*:hive:*:* Versions 2.0.0 – 2.3.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-vjr2-wpfh-5r9p org.apache.ranger:ranger-hive-plugin (Maven) Fixed in 2.4.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40331
  2. 2026-10-03 Alias added: GHSA-vjr2-wpfh-5r9p

References

Patch 1

Advisory 1

Other 5

  • TI-2026-22888 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder CVSS 3.1CRITICAL 9.8
  • TI-2025-36701 Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator CVSS 3.1CRITICAL 9.8
  • TI-2026-40283 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator CVSS 3.1CRITICAL 9.8
  • TI-2026-32358 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation CVSS 3.1CRITICAL 9.8
  • TI-2026-30817 Apache Ranger: Remote Code Execution via JDBC URL Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-29575 Apache Ranger: Privilege Escalation via URL Parameter CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences