EUVD-2026-55252
GHSA-8q3p-j6v6-5x63
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable web parameter with low complexity, but 'privilege escalation' implies an existing low-privilege account (PR:L rather than the vendor's PR:N); full compromise of the policy engine yields High C/I/A.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissions by manipulating a URL parameter, undermining the very access-control layer Ranger is meant to enforce across Hadoop-ecosystem services. Apache rates it CVSS 9.8 with a network, low-complexity, no-privilege vector, though the 'privilege escalation' framing implies a pre-existing foothold that is worth verifying. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite is network reachability to an Apache Ranger deployment at version ≤ 2.8.0, and the ability to issue a request containing the specific manipulated URL parameter that drives the escalation (the exact parameter is not disclosed in the available data). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are genuinely mixed and should not be treated as uniformly critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the primary fix by upgrading to Apache Ranger 2.9.0, which the vendor confirms resolves the issue; this is the recommended and only vendor-endorsed remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Apache Ranger instances and their versions; restrict network access to Ranger administrative interfaces to allow only trusted administrative networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Ranger
View allRemote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-sc
Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letti
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitiv
Command injection in Apache Ranger versions 0.6 through 2.8 allows attackers to inject and execute operating-system comm
Remote code execution in Apache Ranger versions up to and including 2.8.0 stems from unsafe script evaluation in the Gra
SQL injection in Apache Ranger allows remote attackers to inject arbitrary SQL through the application's data-access lay
JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read a
Unauthenticated access to Apache Ranger Download APIs on versions 2.8.0 and earlier exposes sensitive authorization poli
Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and includi
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today