EUVD-2026-55249
GHSA-gh8f-2p9r-x68c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable low-complexity code injection with full host impact, but script/condition evaluation typically requires an authenticated policy-author, so PR:L rather than the vendor's PR:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.
AnalysisAI
Remote code execution in Apache Ranger versions up to and including 2.8.0 stems from unsafe script evaluation in the GraalScriptEngineCreator component, letting an attacker inject and execute arbitrary code (CWE-94) on the Ranger host. Because Ranger is the central authorization and data-governance layer for Hadoop-ecosystem services, compromise can undermine access control across an entire big-data platform. There is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is modest (0.34%, 26th percentile), but the 9.8 CVSS rating reflects the potential for full host compromise once conditions are met.
Technical ContextAI
Apache Ranger provides centralized security administration, fine-grained authorization, and auditing for Hadoop and related data platforms (Hive, HBase, Kafka, HDFS, etc.). The vulnerable GraalScriptEngineCreator is responsible for instantiating a GraalVM/JSR-223 scripting engine used by Ranger to evaluate dynamic expressions such as script-based policy conditions and macros. CWE-94 (Improper Control of Generation of Code / Code Injection) indicates that attacker-influenced input reaches the script engine without adequate sandboxing or input restriction, allowing the supplied script to break out into arbitrary Java/host code execution. The single affected CPE (cpe:2.3:a:apache_software_foundation:apache_ranger) confirms the flaw is in the Ranger product itself rather than a downstream integration.
RemediationAI
Vendor-released patch: upgrade to Apache Ranger 2.9.0, which the Apache project explicitly identifies as the version fixing this issue (advisory: https://lists.apache.org/thread/mqpdrqrvd47x5vhy03xok4ylbo9wbqgj). This is the primary and recommended action. If an immediate upgrade is not possible, reduce exposure by restricting network access to the Ranger Admin web interface and API to trusted management networks only, and tighten who holds policy-authoring/admin privileges so untrusted users cannot define script-based policy conditions that reach the Graal script engine - with the trade-off that limiting policy authoring may slow legitimate administrative workflows. Monitor Ranger audit and application logs for anomalous policy/condition changes as a detective control until patched.
More in Apache Ranger
View allRemote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-sc
Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letti
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissio
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitiv
Command injection in Apache Ranger versions 0.6 through 2.8 allows attackers to inject and execute operating-system comm
SQL injection in Apache Ranger allows remote attackers to inject arbitrary SQL through the application's data-access lay
JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read a
Unauthenticated access to Apache Ranger Download APIs on versions 2.8.0 and earlier exposes sensitive authorization poli
Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and includi
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today