{"id":"CVE-2026-28672","aliases":["EUVD-2026-55254","GHSA-6qc3-v8fv-fv9j"],"status":"published","title":"Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.02631,"percentile":0.85638,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2026-08-10T10:26:32Z","modified":"2026-10-28T02:31:00Z","exploits":[{"source":"pocgithub","id":"oscerd/CVE-2026-28672","title":"oscerd/CVE-2026-28672","date":"2026-08-24","url":"https://github.com/oscerd/CVE-2026-28672"}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.ranger:ranger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0"},{"last_affected":"2.8.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.ranger:ranger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0"},{"last_affected":"2.8.0"}]}],"versions":["0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","1.0.0","1.1.0","1.2.0","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0"]}],"products":[{"vendor":"apache","product":"ranger"},{"vendor":"apache software foundation","product":"apache ranger"}],"references":[{"url":"https://lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb696onzq7","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/09/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28672","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6qc3-v8fv-fv9j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28672.json","tags":["advisory"]},{"url":"https://github.com/apache/ranger","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-28672","title":"Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","status":"published","published":"2026-08-10T10:26:32.654Z","modified":"2026-08-12T15:49:07.214Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-55254","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","status":"published","published":"2026-08-10T10:26:32Z","modified":"2026-08-12T15:49:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:58.302106Z"}],"ghsa":[{"id":"GHSA-6qc3-v8fv-fv9j","title":"Apache Ranger has a Command Injection vulnerability","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","status":"published","published":"2026-08-10T12:31:50Z","modified":"2026-09-02T14:31:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:41:10.121131Z"}],"nvd":[{"id":"CVE-2026-28672","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","status":"published","published":"2026-08-10T11:17:25.19Z","modified":"2026-10-23T20:10:00.16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:12:35.743275Z"}],"osv":[{"id":"CVE-2026-28672","title":"Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","status":"published","published":"2026-08-10T10:26:32.654Z","modified":"2026-10-28T02:31:00.536426249Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-6qc3-v8fv-fv9j","title":"Apache Ranger has a Command Injection vulnerability","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.\n\nThis issue affects Apache Ranger: from 0.6 through 2.8.","status":"published","published":"2026-08-10T12:31:50Z","modified":"2026-09-02T14:55:37.573017Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:39.965326Z"}]}}