CVE-2026-28672

Apache Ranger versions 0.6 through 2.8 are vulnerable to an OS command injection (CWE-77) in the unixusersync module. The vulnerability exists because the UnixUserGroupBuilder class executes the id command through a shell, concatenating an attacker-influenced username directly into the command li...