What is the CVSS score of CVE-2025-59060?

CVE-2025-59060 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Ranger are affected by CVE-2025-59060?

Organizations using Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger should be aware of moderate risk from CVE-2025-59060 rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2025-59060?

Within 30 days: Identify affected systems running Apache Ranger NiFiRegistryClient/NiFiClient is reported in A and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ranger CVE-2025-59060

MEDIUM

Improper Validation of Certificate with Host Mismatch (CWE-297)

2026-03-03 security@apache.org

GHSA-5fvg-qwcp-r325

Apache Ranger

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 03, 2026 - 11:16 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.apache.ranger:ranger-nifi-registry-plugin (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.8.0.

DescriptionCVE.org

Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0.

Users are recommended to upgrade to version 2.8.0, which fixes this issue.

AnalysisAI

Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue. [CVSS 5.3 MEDIUM]

Technical ContextAI

Affects Ranger. Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0.

Users are recommended to upgrade to version 2.8.0, which fixes this issue.

RemediationAI

Update to version 2.8.0 or later. Restrict network access to the affected service where possible.

More in Ranger

View all

CVE-2015-0266 HIGH This Week POC

7.1 Apr 11

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrict

CVE-2015-0265 MEDIUM This Month POC

6.1 Apr 11

Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers

CVE-2016-0733 CRITICAL Act Now

9.8 Apr 12

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which

CVE-2017-7676 CRITICAL Act Now

9.8 Jun 14

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, te

CVE-2024-55532 CRITICAL Act Now

9.8 Mar 03

Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Rat

CVE-2025-59059 CRITICAL Act Now

9.8 Mar 03

RCE in Apache Ranger <= 2.7.0 via NashornScriptEngineCreator. EPSS 0.42%.

CVE-2016-0735 HIGH This Week

8.8 Apr 11

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restr

CVE-2018-11778 HIGH This Week

8.8 Oct 05

UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer

CVE-2016-2174 HIGH This Week

7.2 Jun 13

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administr

CVE-2016-6815 MEDIUM This Month

6.5 Oct 13

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin

CVE-2015-5167 MEDIUM This Month

6.5 Apr 12

The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrict

CVE-2019-12397 MEDIUM This Month

6.1 Aug 08

Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Rated medium

Same weakness CWE-297 – Improper Validation of Certificate with Host Mismatch

View all

CVE-2025-46408 CRITICAL POC

9.8

CVE-2017-2911 MEDIUM POC

5.9

CVE-2017-2912 MEDIUM POC

5.9

CVE-2025-15079 MEDIUM POC

5.3

CVE-2026-15925 CRITICAL

9.2

CVE-2025-68637 CRITICAL

9.1

CVE-2026-26214 CRITICAL

9.1

CVE-2021-33695 CRITICAL

9.1

CVE-2025-59060 vulnerability details – vuln.today

Back

Ranger CVE-2025-59060

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Ranger

Same weakness CWE-297 – Improper Validation of Certificate with Host Mismatch

Share

External POC / Exploit Code