Vulnerabilities

TI-2026-22888 CVE-2026-28672 · GHSA-6qc3-v8fv-fv9j

Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

MEDIUM 54

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02631 Published 2026-08-10 No fix listed CWE-77

TI-2026-24757 CVE-2026-32227 · GHSA-8w96-gvmm-v92g

Apache Ranger: SQL Injection vulnerability in lookup functionality

MEDIUM 50

SQL Injection vulnerability vulnerability in Apache Ranger.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00686 Published 2026-08-10 No fix listed CWE-89

TI-2026-29575 CVE-2026-40920 · GHSA-8q3p-j6v6-5x63

Apache Ranger: Privilege Escalation via URL Parameter

MEDIUM 50

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00732 Published 2026-08-10 No fix listed CWE-20

TI-2026-30817 CVE-2026-42537 · GHSA-4rwg-mr3v-x763

Apache Ranger: Remote Code Execution via JDBC URL Injection

MEDIUM 51

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01289 Published 2026-08-10 No fix listed CWE-20

TI-2026-32358 CVE-2026-44416 · GHSA-3236-74vm-475v

Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

MEDIUM 51

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01242 Published 2026-08-10 No fix listed CWE-470

TI-2026-40283 CVE-2026-55799 · GHSA-gh8f-2p9r-x68c

Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator

MEDIUM 51

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01216 Published 2026-08-10 No fix listed CWE-94

TI-2026-40292 CVE-2026-55814 · GHSA-r575-fqmx-qqgc

Apache Ranger: Download APIs expose plugin data without authentication

MEDIUM 40

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00657 Published 2026-08-10 No fix listed CWE-306

TI-2026-46978 CVE-2026-65942 · GHSA-qr4j-jp4m-6jhm

Apache Ranger: Clients accept TLS certificates issued for other hostnames

MEDIUM 40

TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00589 Published 2026-08-10 No fix listed CWE-297

TI-2026-46981 CVE-2026-65945 · GHSA-c3hc-q36q-95g4

Apache Ranger: Logs contain replayable JWT bearer tokens

LOW 36

Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00637 Published 2026-08-10 No fix listed CWE-532

TI-2026-46984 CVE-2026-65948 · GHSA-vx4h-hjjm-mwrc

Apache Ranger: UnixAuth lacks brute-force protection

LOW 39

UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00618 Published 2026-08-10 No fix listed CWE-307

TI-2025-36702 CVE-2025-59060 · GHSA-5fvg-qwcp-r325

Apache Ranger: Hostname verification bypass in NiFiRegistryClient

LOW 31

Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00509 Published 2026-03-03 Fixed in 2.8.0 CWE-297

TI-2025-36701 CVE-2025-59059 · GHSA-c87w-642h-m97h

Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator

MEDIUM 52

Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01379 Published 2026-03-03 Fixed in 2.8.0 CWE-94

TI-2024-36864 CVE-2024-55532 · GHSA-2h4w-p9fh-9rmv

Apache Ranger: Improper Neutralization of Formula Elements in a CSV File

MEDIUM 50

Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00814 Published 2025-03-03 Fixed in 2.6.0 CWE-1236

TI-2024-30522 CVE-2024-45479 · GHSA-g9gf-g5jq-9h3v

Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost

MEDIUM 48

SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00687 Published 2025-01-21 Fixed in 2.5.0 CWE-918

TI-2024-30521 CVE-2024-45478 · GHSA-vrx2-mgr9-v67h

Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input

LOW 23

Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00607 Published 2025-01-21 Fixed in 2.5.0 CWE-79

TI-2021-17404 CVE-2021-40331 · GHSA-vjr2-wpfh-5r9p

Permissions problem in the Apache Ranger Hive Plugin

LOW 39

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00918 Published 2023-05-05 Fixed in 2.4.0 CWE-732

TI-2022-22145 CVE-2022-45048 · GHSA-89gw-cffj-mqg9

Apache Ranger: code execution vulnerability in policy expressions

MEDIUM 42

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01126 Published 2023-05-05 Fixed in 2.4.0 CWE-74

TI-2019-09244 CVE-2019-12397 · GHSA-fpqp-v323-44xv

Cross-site scripting in Apache Ranger

LOW 33

Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02965 Published 2019-08-08 Fixed in 2.0.0 CWE-79

TI-2018-08435 CVE-2018-11778 · GHSA-c99h-fgqm-6679

Out-of-bounds write in Apache Ranger

MEDIUM 45

UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04011 Published 2018-10-05 Fixed in 1.2.0 CWE-787

TI-2016-05856 CVE-2016-6815 · GHSA-vhxc-8jjq-859j

Credentials management flaw in Apache Ranger

LOW 33

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02071 Published 2017-10-13 Fixed in 0.6.2 CWE-255

TI-2017-05313 CVE-2017-7677 · GHSA-ffjh-fjgg-mfpq

Missing authorization in Apache Ranger

LOW 31

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02614 Published 2017-06-14 Fixed in 0.7.1 CWE-862

TI-2017-05312 CVE-2017-7676 · GHSA-758m-6g3q-g3hh

Improper input validation in Apache Ranger

MEDIUM 49

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04198 Published 2017-06-14 Fixed in 0.7.1 CWE-20

TI-2016-07208 CVE-2016-8751 · GHSA-v7mf-qgxf-qmvf

Cross-site scripting in Apache Ranger

LOW 26

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.02133 Published 2017-06-14 Fixed in 0.6.3 CWE-79

TI-2016-07203 CVE-2016-8746 · GHSA-xv7x-x6wr-xx7g

Untrusted search path in Apache Ranger

LOW 32

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02733 Published 2017-06-14 Fixed in 0.6.3 CWE-426

TI-2016-04673 CVE-2016-5395 · GHSA-rf7q-xqm3-6923

Cross-site scripting (XSS) vulnerability in the create user functionality in the policy…

LOW 26

Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vecto…

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.02105 Published 2016-09-26 Fixed in 0.6.1 CWE-79

Vulnerabilities

Filters