Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Apache Ranger — Vulnerabilities & Security Advisories 23

All 23 CVE vulnerabilities found in Apache Ranger, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses affecting the Apache Ranger access control framework, specifically categorized under the vendor Apache and tagged with relevant vulnerability types. The collection encompasses a comprehensive range of issues including privilege escalation, remote code execution, and information disclosure flaws reported across multiple versions from the initial public release through the current stable distribution. Readers can utilize this resource to track official vendor advisories for timely remediation, analyze the prevalence and impact of specific weakness classes within the data governance ecosystem, or review the complete historical vulnerability record for Apache Ranger to inform security assessments and risk management strategies. The data presented here serves as a centralized reference for security professionals seeking to understand the evolving threat landscape surrounding this critical open-source component without relying on fragmented external sources. By consolidating these findings, the page facilitates efficient correlation between discovered exploits and existing patches, enabling organizations to maintain robust security postures while managing complex permission policies. This aggregation supports proactive defense measures by highlighting recurring patterns in the product's security evolution and providing clear visibility into the timeline of disclosed defects.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder CWE-77 - - 2026-08-10
CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality CWE-89 - - 2026-08-10
CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter CWE-269 - - 2026-08-10
CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection CWE-94 - - 2026-08-10
CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation CWE-94 - - 2026-08-10
CVE-2026-55799 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator CWE-94 - - 2026-08-10
CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication CWE-306 - - 2026-08-10
CVE-2026-65942 Apache Ranger: Clients accept TLS certificates issued for other hostnames CWE-297 - - 2026-08-10
CVE-2026-65945 Apache Ranger: Logs contain replayable JWT bearer tokens CWE-532 - - 2026-08-10
CVE-2026-65948 Apache Ranger: UnixAuth lacks brute-force protection CWE-307 - - 2026-08-10
CVE-2025-59060 Apache Ranger: Hostname verification bypass in NiFiRegistryClient CWE-297 5.3AI Medium AI 2026-03-03
CVE-2025-59059 Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator CWE-94 9.8AI Critical AI 2026-03-03
CVE-2024-55532 Apache Ranger: Improper Neutralization of Formula Elements in a CSV File CWE-1236 9.8 - 2025-03-03
CVE-2024-45479 Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost CWE-918 5.3 - 2025-01-21
CVE-2024-45478 Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input CWE-79 5.4 - 2025-01-21
CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions CWE-74 8.4 High 2023-05-05
CVE-2019-12397 Apache Ranger 跨站脚本漏洞 6.1 - 2019-08-08
CVE-2018-11778 Apache Ranger 缓冲区错误漏洞 8.8 - 2018-10-05
CVE-2016-6815 Apache Ranger 信任管理漏洞 6.5 - 2017-10-13
CVE-2017-7677 Apache Ranger Hive Authorizer 安全漏洞 7.5 - 2017-06-14
CVE-2017-7676 Apache Ranger Policy resource matcher 输入验证漏洞 9.1 - 2017-06-14
CVE-2016-8751 Apache Ranger 跨站脚本漏洞 4.8 - 2017-06-14
CVE-2016-8746 Apache Ranger 安全漏洞 5.9 - 2017-06-14

All 23 known CVE vulnerabilities affecting Apache Ranger with full Chinese analysis, references, and POCs where available.