CVE-2026-32227

CVE-2026-32227 describes a SQL Injection vulnerability in Apache Ranger affecting the lookup functionality. The issue is addressed by upgrading to version 2.9.0. The associated metrics indicate a critical overall impact (Confidentiality, Integrity, Availability). No exploitation details are provi...

CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...

EUVD-2026-55252

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-40920

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-42537

Apache Ranger suffers Remote Code Execution via JDBC URL Injection in versions

EUVD-2026-55250

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-44416

CVE-2026-44416 affects Apache Ranger, specifically the plugin-schema-registry component. The publicly disclosed details show a Remote Code Execution vulnerability via arbitrary class instantiation in Ranger

CVE-2026-55799

CVE-2026-55799 documents a Remote Code Execution vulnerability in the GraalScriptEngineCreator component of Apache Ranger

CVE-2026-55799

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55248

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55247

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65942 Apache Ranger: Clients accept TLS certificates issued for other hostnames

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65942

CVE-2026-65942 concerns TLS hostname verification in Apache Ranger Client Code for versions

EUVD-2026-55246

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65945

Apache Ranger is affected by CVE-2026-65945 where logs contain replayable JWT tokens in versions

EUVD-2026-55245

UnixAuth lacks brute-force protection in Apache Ranger versions = 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65948 Apache Ranger: UnixAuth lacks brute-force protection

UnixAuth lacks brute-force protection in Apache Ranger versions = 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65948

The CVE-2026-65948 entry concerns Apache Ranger’s UnixAuth, which lacks brute-force protection in versions ≤ 2.8.0. This absence can enable brute-force authentication attempts against UnixAuth. The notes recommend upgrading to version 2.9.0, which fixes the issue. UnixAuth is explicitly labeled a...