Apache Software Foundation Apache Ranger
23 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-28672 | 0.6 – 2.8 | Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder | CRITICAL 9.8 | 2.6 % | ||
| CVE-2026-32227 | | Apache Ranger: SQL Injection vulnerability in lookup functionality | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-40920 | ≤ 2.8.0 | Apache Ranger: Privilege Escalation via URL Parameter | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-42537 | ≤ 2.8.0 | Apache Ranger: Remote Code Execution via JDBC URL Injection | CRITICAL 9.8 | 1.3 % | ||
| CVE-2026-44416 | ≤ 2.8.0 | Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-55799 | ≤ 2.8.0 | Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-55814 | ≤ 2.8.0 | Apache Ranger: Download APIs expose plugin data without authentication | HIGH 7.5 | 0.7 % | ||
| CVE-2026-65942 | ≤ 2.8.0 | Apache Ranger: Clients accept TLS certificates issued for other hostnames | HIGH 7.5 | 0.6 % | ||
| CVE-2026-65945 | ≤ 2.8.0 | Apache Ranger: Logs contain replayable JWT bearer tokens | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-65948 | ≤ 2.8.0 | Apache Ranger: UnixAuth lacks brute-force protection | HIGH 7.3 | 0.6 % | ||
| CVE-2025-59060 | ≤ 2.7.0 | Apache Ranger: Hostname verification bypass in NiFiRegistryClient | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-59059 | ≤ 2.7.0 | Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator | CRITICAL 9.8 | 1.4 % | ||
| CVE-2024-55532 | ≤ 2.5.0 | Apache Ranger: Improper Neutralization of Formula Elements in a CSV File | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-45479 | 2.4.0 – < 2.5.0 | Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost | CRITICAL 9.1 | 0.7 % | ||
| CVE-2024-45478 | 2.4.0 – < 2.5.0 | Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input | MEDIUM 4.8 | 0.6 % | ||
| CVE-2022-45048 | 2.3.0 | Apache Ranger: code execution vulnerability in policy expressions | HIGH 8.8 | 1.1 % | ||
| CVE-2019-12397 | 0.7.0 to 1.2.0 | Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version | MEDIUM 6.1 | 3.0 % | ||
| CVE-2018-11778 | prior to 1.2.0 | UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions p | HIGH 8.8 | 4.0 % | ||
| CVE-2016-6815 | 0.5.x ; 0.6.0 ; 0.6.1 | In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role. | MEDIUM 6.5 | 2.1 % | ||
| CVE-2017-7677 | 0.5.x ; 0.6.x ; 0.7.0 | In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission | MEDIUM 5.9 | 2.6 % | ||
| CVE-2017-7676 | 0.5.x ; 0.6.x ; 0.7.0 | Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can re | CRITICAL 9.8 | 4.2 % | ||
| CVE-2016-8751 | 0.5.x ; 0.6.0 - 0.6.2 | Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store s | MEDIUM 4.8 | 2.1 % | ||
| CVE-2016-8746 | 0.6.0 - 0.6.2 | Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recu | MEDIUM 5.9 | 2.7 % |