Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Ranger

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-28672 Public exploit

    Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  • Critical 9.8
    CVE-2026-32227

    Apache Ranger: SQL Injection vulnerability in lookup functionality

    SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue.

    Apache Software Foundation Apache Ranger
  • Critical 9.8
    CVE-2026-40920

    Apache Ranger: Privilege Escalation via URL Parameter

    Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

    Apache Software Foundation Apache Ranger
  • Critical 9.8
    CVE-2026-42537

    Apache Ranger: Remote Code Execution via JDBC URL Injection

    Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

    Apache Software Foundation Apache Ranger
  • Critical 9.8
    CVE-2026-44416

    Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

    Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

    Apache Software Foundation Apache Ranger
  • Critical 9.8
    CVE-2026-55799

    Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator

    Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

    Apache Software Foundation Apache Ranger
  • Critical 9.8
    CVE-2025-59059 Public exploit

    Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator

    Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.

    Apache Software Foundation Apache Ranger druid trino-plugin-ranger Wolfi Maven
  • Critical 9.8
    CVE-2024-55532

    Apache Ranger: Improper Neutralization of Formula Elements in a CSV File

    Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue.

    Apache Software Foundation Apache Ranger org.apache.ranger:security-admin-web Maven
  • Critical 9.1
    CVE-2024-45479

    Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost

    SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  • Critical 9.8
    CVE-2017-7676

    Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character

    Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven