Apache Software Foundation Apache Ranger
23 CVEs affecting Apache Software Foundation Apache Ranger. Latest disclosed: 2026-08-10. Critical: 10, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55799 | Critical | 9.8 | 2026-08-10 | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this i… |
CVE-2026-44416 | Critical | 9.8 | 2026-08-10 | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to vers… |
CVE-2026-42537 | Critical | 9.8 | 2026-08-10 | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-40920 | Critical | 9.8 | 2026-08-10 | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this iss… |
CVE-2026-32227 | Critical | 9.8 | 2026-08-10 | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue. |
CVE-2026-28672 | Critical | 9.8 | 2026-08-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6… |
CVE-2025-59059 | Critical | 9.8 | 2026-03-03 | Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2… |
CVE-2024-55532 | Critical | 9.8 | 2025-03-03 | Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to versio… |
CVE-2017-7676 | Critical | 9.8 | 2017-06-14 | Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended… |
CVE-2024-45479 | Critical | 9.1 | 2025-01-21 | SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, wh… |
CVE-2018-11778 | High | 8.8 | 2018-10-05 | UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 shoul… |
CVE-2022-45048 | High | 8.4 | 2023-05-05 | Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache… |
CVE-2026-65942 | High | 7.5 | 2026-08-10 | TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-55814 | High | 7.5 | 2026-08-10 | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-65948 | High | 7.3 | 2026-08-10 | UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are r… |
CVE-2026-65945 | Medium | 6.5 | 2026-08-10 | Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2016-6815 | Medium | 6.5 | 2017-10-13 | In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role. |
CVE-2019-12397 | Medium | 6.1 | 2019-08-08 | Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger w… |
CVE-2017-7677 | Medium | 5.9 | 2017-06-14 | In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table. |
CVE-2016-8746 | Medium | 5.9 | 2017-06-14 | Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to t… |