Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-42537 EUVD-2026-55251GHSA-4rwg-mr3v-x763

Apache Ranger: Remote Code Execution via JDBC URL Injection

Published Aug 10, 2026 · Updated Aug 12, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Ranger

Description

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Ranger ≤ 2.8.0 —

References