What is the CVSS score of CVE-2026-32227?

CVE-2026-32227 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Ranger are affected by CVE-2026-32227?

A critical vulnerability in Apache Ranger could allow attackers to tamper with organization-wide access control policies and audit records.

How to fix or mitigate CVE-2026-32227?

Within 24 hours, identify all Apache Ranger deployments and implement immediate network access restrictions to administrative interfaces, limiting access to authorized personnel and known IP ranges. Within 7 days, validate Apache Ranger version 2.9.0 in a non-production environment to confirm compatibility with existing policies and dependent applications. Within 30 days, deploy version 2.9.0 to all production Ranger instances and conduct post-upgrade verification of policy enforcement and data access controls.

Apache Ranger CVE-2026-32227

EUVD-2026-55253 CRITICAL

SQL Injection (CWE-89)

2026-08-10 apache

GHSA-8w96-gvmm-v92g

Apache SQLi Apache Ranger Apache Software Foundation

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable low-complexity SQLi with full DB read/write/destroy gives C:H/I:H/A:H; PR:N retained per the input vector but auth requirement is unconfirmed and could raise PR.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 12, 2026 - 16:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 12, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Aug 12, 2026 - 16:22 NVD

9.8 (CRITICAL)

Analysis Generated

Aug 10, 2026 - 11:08 vuln.today

DescriptionCVE.org

SQL Injection vulnerability vulnerability in Apache Ranger.

This issue affects .

Users are recommended to upgrade to version 2.9.0, which fixes the issue.

AnalysisAI

SQL injection in Apache Ranger allows remote attackers to inject arbitrary SQL through the application's data-access layer, exposing the backing policy/audit database to full read, modification, and destruction. Because Ranger is the centralized authorization and access-control service for Hadoop and related big-data platforms, compromise here can undermine security policy enforcement across an entire data estate. Rated CVSS 9.8; no public exploit identified at time of analysis, EPSS is low (0.21%, 12th percentile), and the flaw is fixed in version 2.9.0.

Technical ContextAI

Apache Ranger is an open-source framework for centralized authorization, auditing, and data governance across the Hadoop ecosystem (HDFS, Hive, HBase, Kafka, YARN, etc.), with a Ranger Admin web/REST tier backed by a relational database (typically MySQL/MariaDB, PostgreSQL, or Oracle) that stores policies, users, roles, and audit records. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into a database query without proper parameterization or escaping, letting an attacker alter query logic. The affected component per CPE is cpe:2.3:a:apache_software_foundation:apache_ranger - the exact vulnerable sub-module (e.g., a specific search/filter or REST endpoint in Ranger Admin) is not specified in the available advisory text.

RemediationAI

Vendor-released patch: 2.9.0 - upgrade Apache Ranger to 2.9.0, which fixes the issue per the Apache advisory (https://lists.apache.org/thread/1zltfzd6rp683omrlv1zkxvkwm9d0nd2). Until the upgrade can be scheduled, reduce exposure by restricting network access to the Ranger Admin service and its REST API to trusted management networks or a VPN/bastion (trade-off: may disrupt automation or plugins that call the API from other hosts), placing a WAF or reverse proxy in front of Ranger Admin to filter SQL metacharacters on request parameters (trade-off: signature-based filtering can be bypassed and may cause false positives on legitimate policy names), and ensuring the database account used by Ranger runs with least privilege so injected queries cannot escalate beyond the Ranger schema (trade-off: limits blast radius but does not close the injection). Review Ranger audit and database query logs for anomalous statements as a detection measure.