Apache Ranger vulnerabilities

• apache ranger Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder CVE-2026-28672 Public exploit 9.8 CriticalAugust 10, 2026
• apache ranger Apache Ranger: SQL Injection vulnerability in lookup functionality CVE-2026-32227 9.8 CriticalAugust 10, 2026
• apache ranger Apache Ranger: Privilege Escalation via URL Parameter CVE-2026-40920 9.8 CriticalAugust 10, 2026
• apache ranger Apache Ranger: Remote Code Execution via JDBC URL Injection CVE-2026-42537 9.8 CriticalAugust 10, 2026
• apache ranger Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation CVE-2026-44416 9.8 CriticalAugust 10, 2026
• apache ranger Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator CVE-2026-55799 9.8 CriticalAugust 10, 2026
• apache ranger Apache Ranger: Download APIs expose plugin data without authentication CVE-2026-55814 7.5 HighAugust 10, 2026
• apache ranger Apache Ranger: Clients accept TLS certificates issued for other hostnames CVE-2026-65942 7.5 HighAugust 10, 2026
• apache ranger Apache Ranger: Logs contain replayable JWT bearer tokens CVE-2026-65945 6.5 MediumAugust 10, 2026
• apache ranger Apache Ranger: UnixAuth lacks brute-force protection CVE-2026-65948 7.3 HighAugust 10, 2026
• apache ranger Apache Ranger: Hostname verification bypass in NiFiRegistryClient CVE-2025-59060 Fix available 5.3 MediumMarch 3, 2026
• apache ranger Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator CVE-2025-59059 Public exploitFix available 9.8 CriticalMarch 3, 2026
• apache ranger Apache Ranger: Improper Neutralization of Formula Elements in a CSV File CVE-2024-55532 Fix available 9.8 CriticalMarch 3, 2025
• apache ranger Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost CVE-2024-45479 Fix available 9.1 CriticalJanuary 21, 2025
• apache ranger Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input CVE-2024-45478 Fix available 4.8 MediumJanuary 21, 2025
• apache ranger, apache software foundation ranger hive plugin +1 more Permissions problem in the Apache Ranger Hive Plugin CVE-2021-40331 Fix available 8.1 HighMay 5, 2023
• apache ranger Apache Ranger: code execution vulnerability in policy expressions CVE-2022-45048 Fix available 8.4 HighMay 5, 2023
• apache ranger Cross-site scripting in Apache Ranger CVE-2019-12397 Fix available 6.1 MediumAugust 8, 2019
• apache ranger UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow CVE-2018-11778 Fix available 8.8 HighOctober 5, 2018
• apache ranger Moderate severity vulnerability that affects org.apache.ranger:ranger CVE-2016-6815 Fix available 6.5 MediumOctober 13, 2017
• apache ranger Moderate severity vulnerability that affects org.apache.ranger:ranger CVE-2017-7677 Fix available 5.9 MediumJune 14, 2017
• apache ranger Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character CVE-2017-7676 Fix available 9.8 CriticalJune 14, 2017
• apache ranger Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies CVE-2016-8751 Fix available 4.8 MediumJune 14, 2017
• apache ranger Apache Ranger policy engine incorrectly matches paths in certain conditions CVE-2016-8746 Fix available 5.9 MediumJune 14, 2017
• apache ranger Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML CVE-2016-5395 Fix available 4.8 MediumSeptember 26, 2016
• apache ranger SQL injection vulnerability in the policy admin tool in Apache Ranger CVE-2016-2174 Fix available 7.2 HighJune 13, 2016
• apache ranger The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password CVE-2016-0733 Fix available 9.8 CriticalApril 12, 2016
• apache ranger Apache Ranger allows users to bypass intended access restrictions via the REST API CVE-2015-5167 Fix available 6.5 MediumApril 12, 2016
• apache ranger Apache Ranger Access Restriction Bypass CVE-2016-0735 Fix available 8.8 HighApril 11, 2016
• apache ranger Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs CVE-2015-0266 Fix available 7.1 HighApril 11, 2016
• apache ranger Apache Ranger Cross-site Scripting vulnerability CVE-2015-0265 Fix available 6.1 MediumApril 11, 2016