CVE-2025-59059

Apache Ranger CVE-2025-59059 is a remote code execution issue affecting Ranger versions

CVE-2024-55532

CVE-2024-55532 affects Apache Ranger prior to 2.6.0, in the Export CSV feature. The root cause is Improper Neutralization of Formula Elements, which can enable CSV injection when exporting data. Multiple connected sources (Red Hat, SNYK, OSV, GHSA, and CVE listings) corroborate that the remediati...

CVE-2016-8751

CVE-2016-8751 affects Apache Ranger prior to 0.6.3. The vulnerability is a Stored Cross-Site Scripting in custom policy conditions, enabling admin users to store JavaScript executed when normal users log in and access policies. Exploitation details, affected versions beyond 0.6.3, and remediation...

CVE-2018-11778

CVE-2018-11778 affects UnixAuthenticationService in Apache Ranger. Multiple connected sources confirm that UnixAuthenticationService handles user input and previously vulnerable versions could be susceptible to a stack-based buffer overflow, potentially allowing crash or arbitrary code execution....

CVE-2026-55814

CVE-2026-55814 associates a missing-authentication flaw in the Apache Ranger Download APIs for versions ≤ 2.8.0, potentially exposing plugin data. The issue is mitigated by upgrading to version 2.9.0, which is stated as fixing the vulnerability. Exploitation details or in‑the‑wild status are not ...

CVE-2026-42537

Apache Ranger suffers Remote Code Execution via JDBC URL Injection in versions

CVE-2026-55799

CVE-2026-55799 documents a Remote Code Execution vulnerability in the GraalScriptEngineCreator component of Apache Ranger

CVE-2026-65942

CVE-2026-65942 concerns TLS hostname verification in Apache Ranger Client Code for versions

CVE-2026-40920

CVE-2026-40920 concerns Apache Ranger: Privilege Escalation via URL Parameter in versions

CVE-2026-32227

CVE-2026-32227 describes a SQL Injection vulnerability in Apache Ranger affecting the lookup functionality. The issue is addressed by upgrading to version 2.9.0. The associated metrics indicate a critical overall impact (Confidentiality, Integrity, Availability). No exploitation details are provi...

CVE-2025-59060

Summary: CVE-2025-59060 describes a hostname verification bypass in Apache Ranger’s NiFiRegistryClient/NiFiClient. The issue is reported for Apache Ranger versions ≤ 2.7.0 and is fixed by upgrading to version 2.8.0. Affected components: NiFiRegistryClient and NiFiClient within Apache Ranger. Root...

CVE-2026-44416

CVE-2026-44416 affects Apache Ranger, specifically the plugin-schema-registry component. The publicly disclosed details show a Remote Code Execution vulnerability via arbitrary class instantiation in Ranger

CVE-2026-65945

Apache Ranger is affected by CVE-2026-65945 where logs contain replayable JWT tokens in versions

CVE-2026-65948

The CVE-2026-65948 entry concerns Apache Ranger’s UnixAuth, which lacks brute-force protection in versions ≤ 2.8.0. This absence can enable brute-force authentication attempts against UnixAuth. The notes recommend upgrading to version 2.9.0, which fixes the issue. UnixAuth is explicitly labeled a...