CVE-2021-40331

Permissions problem in the Apache Ranger Hive Plugin

8.1 HighFix available

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.92%Up 0.9 points since May 5, 2023

What each source reports

NVD Score used 8.1

Record: CVE-2021-40331
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-732
Updated: 2026-11-02

CVE List 8.1

Permissions problem in the Apache Ranger Hive Plugin

Record: CVE-2021-40331
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-732
Updated: 2026-11-02

EUVDEUVD-2023-1629 8.1

Record: EUVD-2023-1629
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vjr2-wpfh-5r9p 8.1

Apache Ranger Hive Plugin missing permissions check

Record: GHSA-vjr2-wpfh-5r9p
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-732
Updated: 2026-11-02

OSV 8.1

Record: CVE-2021-40331
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVGHSA-vjr2-wpfh-5r9p 8.1

Apache Ranger Hive Plugin missing permissions check

Record: GHSA-vjr2-wpfh-5r9p
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-732
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.ranger:ranger-hive-plugin` Maven	2.0.0 up to 2.4.0	2.4.0
`org.apache.ranger:ranger-hive-plugin` Maven	2.0.0 up to 2.4.0, plus listed versions 2.1.02.2.02.3.0	2.4.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-40331 is a high vulnerability (CVSS 8.1) in Apache Ranger, published May 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in org.apache.ranger:ranger-hive-plugin 2.4.0.