Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Ranger

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2026-55814

    Apache Ranger: Download APIs expose plugin data without authentication

    Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

    Apache Software Foundation Apache Ranger
  • High 7.5
    CVE-2026-65942

    Apache Ranger: Clients accept TLS certificates issued for other hostnames

    TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

    Apache Software Foundation Apache Ranger
  • High 7.3
    CVE-2026-65948

    Apache Ranger: UnixAuth lacks brute-force protection

    UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a recommended option for production deployments.  Users are recommended to upgrade to version 2.9.0, which fixes this issue.

    Apache Software Foundation Apache Ranger
  • High 8.4
    CVE-2022-45048

    Apache Ranger: code execution vulnerability in policy expressions

    Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven
  • High 8.8
    CVE-2018-11778

    UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow

    UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0

    Apache Software Foundation Apache Ranger org.apache.ranger:ranger Maven