Ranger (Apache) - vulnerabilities (CVEs)

31 CVEs, 0 in the last 30 days, 92 known versions, newest CVE from 2026-08-10. Vendor: Apache.

CVEs of Ranger

CVE-2026-28672 - CVSS 9.8 (critical), 2026-08-10: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6…
CVE-2026-32227 - CVSS 9.8 (critical), 2026-08-10: SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue.
CVE-2026-40920 - CVSS 9.8 (critical), 2026-08-10: Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this…
CVE-2026-42537 - CVSS 9.8 (critical), 2026-08-10: Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-44416 - CVSS 9.8 (critical), 2026-08-10: Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to…
CVE-2026-55799 - CVSS 9.8 (critical), 2026-08-10: Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this…
CVE-2026-55814 - CVSS 7.5 (high), 2026-08-10: Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-65942 - CVSS 7.5 (high), 2026-08-10: TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-65945 - CVSS 6.5 (medium), 2026-08-10: Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVE-2026-65948 - CVSS 7.3 (high), 2026-08-10: UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are…
CVE-2025-59060 - CVSS 5.3 (medium), 2026-03-03: Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to…
CVE-2025-59059 - CVSS 9.8 (critical), 2026-03-03: Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version…
CVE-2024-55532 - CVSS 9.8 (critical), 2025-03-03: Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to…
CVE-2024-45479 - CVSS 9.1 (critical), 2025-01-21: SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0,…
CVE-2024-45478 - CVSS 4.8 (medium), 2025-01-21: Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger…
CVE-2022-45048 - CVSS 8.8 (high), 2023-05-05: Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects…
CVE-2021-40331 - CVSS 8.1 (high), 2023-05-05: An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a…
CVE-2019-12397 - CVSS 6.1 (medium), 2019-08-08: Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger…
CVE-2018-11778 - CVSS 8.8 (high), 2018-10-05: UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0…
CVE-2016-6815 - CVSS 6.5 (medium), 2017-10-13: In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.
CVE-2016-8746 - CVSS 5.9 (medium), 2017-06-14: Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to…
CVE-2017-7677 - CVSS 5.9 (medium), 2017-06-14: In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.
CVE-2017-7676 - CVSS 9.8 (critical), 2017-06-14: Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended…
CVE-2016-8751 - CVSS 4.8 (medium), 2017-06-14: Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary…
CVE-2016-5395 - CVSS 4.8 (medium), 2016-09-26: Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated…
CVE-2016-2174 - CVSS 7.2 (high), 2016-06-13: SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL…
CVE-2016-0733 - CVSS 9.8 (critical), 2016-04-12: The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass…
CVE-2015-5167 - CVSS 6.5 (medium), 2016-04-12: The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API.
CVE-2016-0735 - CVSS 8.8 (high), 2016-04-11: Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a…
CVE-2015-0266 - CVSS 7.1 (high), 2016-04-11: The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
CVE-2015-0265 - CVSS 6.1 (medium), 2016-04-11: Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML…