2026-08-10

CVE-2026-65948 Aug 10, 10:20 HIGH This Week

Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and including 2.8.0, because the authentication endpoint imposes no rate limiting, account lockout, or anti-automation controls (CWE-307). Any deployment that has explicitly configured UnixAuth - a configuration the vendor labels as not recommended for production - exposes its Ranger admin interface to automated password-guessing from unauthenticated network attackers. No active exploitation is recorded in CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network vector (AV:N/PR:N/AC:L) makes automated credential attacks trivially executable against any network-reachable instance.