EUVD-2026-55248
GHSA-r575-fqmx-qqgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover network-accessible Ranger Admin service
-
ExploitSend unauthenticated HTTP GET to Download API endpoint
-
ExecutionReceive sensitive policy and configuration export
-
ImpactMap authorization topology for further targeting
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Any Apache Ranger deployment running version 2.8.0 or earlier where the Ranger Admin web service is reachable over the network is vulnerable. The CVSS vector PR:N/AC:L/UI:N confirms no authentication, no elevated complexity, and no user interaction are required. No non-default configuration or specific feature flag enables the flaw - the Download APIs are part of the standard Ranger Admin surface. The primary limiting factor is network reachability: deployments where Ranger Admin is isolated to a strictly controlled internal segment or behind a strong perimeter ACL face reduced exposure from external attackers, though insider threats remain. There is no platform-specific constraint identified in the available data. |
| Impact | The CVSS 3.1 base score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the risk posture: this is a remotely exploitable, zero-interaction, zero-authentication information disclosure vulnerability with high confidentiality impact. Even a mid-sized municipal IT team in gdynia relying on Apache Ranger to enforce data lake access controls should treat this as urgent, given that exfiltrated policy data could reveal the full authorization topology of an organization's data platform. No EPSS data was provided in the input, so quantitative exploitation probability cannot be stated; however, the low attack complexity implies that exploitation requires no specialized knowledge beyond basic HTTP tooling. The absence of a CISA KEV listing and confirmed POC moderates the immediate threat level compared to actively weaponized vulnerabilities, but the vulnerability has been disclosed publicly via the Apache mailing list and oss-security, increasing the window of community awareness. |
| Exploit ScenarioDerived | An external or internal attacker identifies a network-accessible Apache Ranger Admin instance running version 2.8.0 or earlier. They send a standard unauthenticated HTTP GET request to a Download API endpoint - no credentials, tokens, or session setup required. The server responds with sensitive authorization policy data, revealing the organization's full data access control topology, which an attacker can use to map privileged data paths for subsequent targeted attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 10, 2026
Unauthenticated access to Apache Ranger Download APIs on versions 2.8.0 and earlier exposes sensitive authorization policy data to any remote attacker with network connectivity. The missing authentication check (CWE-306) means no credentials or privileges are required to invoke these endpoints and retrieve their output. No public exploit code has been identified at time of analysis, but the low complexity and zero-authentication nature of the CVSS vector (AV:N/AC:L/PR:N/UI:N) makes this trivially exploitable by any attacker who can reach the Ranger Admin interface.
Earlier versions of this analysis (1)
Missing authentication controls on Apache Ranger's Download APIs expose sensitive policy and configuration data to unauthenticated network access on all versions through 2.8.0. This CWE-306 (Missing Authentication for Critical Function) flaw is significant because Apache Ranger is itself a security enforcement platform - authentication bypass in the security layer managing Hadoop ecosystem access controls represents a fundamental trust failure. The Apache Software Foundation has released version 2.9.0 as the remediation; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Upgrade Apache Ranger to version 2.9.0, which resolves this issue per the vendor advisory at https://lists.apache.org/thread/yoorhnbxfydb5xoxlxlmms0f268rj9dh. If immediate upgrade is not feasible, restrict network access to the Ranger Admin web service using perimeter firewall rules or reverse proxy ACLs so that only trusted internal hosts can reach the Admin API port - this reduces the attack surface to internal threat actors but does not fix the underlying missing authentication flaw. Additionally, review access logs for the Download API endpoints to identify any unauthorized access that may have occurred prior to patching. Do not expose the Ranger Admin interface to the public internet under any circumstances while running a vulnerable version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Ranger is an open-source centralized security administration framework primarily used in Hadoop ecosystem deployments to manage fine-grained authorization policies for services such as HDFS, Hive, HBase, and Kafka. The affected components are the Download APIs - endpoints used to export policy definitions, audit configurations, or security rule sets. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: these API routes bypass the authentication enforcement layer entirely, allowing unauthenticated HTTP clients to invoke them. The CPE string cpe:2.3:a:apache_software_foundation:apache_ranger:*:*:*:*:*:*:*:* covers all versions of the product through 2.8.0, as confirmed by ENISA EUVD-2026-55248.
Know when Apache Ranger gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated read-only API; no integrity or availability impact since only policy data disclosure is described.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Articles & Coverage 1
Executive ViewAI
Apache Ranger authorization policy data is exposed to unauthenticated remote attackers on versions 2.8.0 and earlier, allowing anyone with network access to retrieve sensitive access control configurations. This exposes the complete authorization framework-defining who can perform what actions across connected systems-to adversaries without requiring credentials. Organizations relying on Ranger for access governance must immediately restrict network access and implement interim authentication controls to prevent attackers from mapping authorization structures and planning privilege escalation.
Network segmentation restricting Ranger Admin interface access to authorized administrators and networks only; authentication proxy or reverse proxy requiring additional credentials before any Ranger Admin access is granted; continuous real-time monitoring and alerting on Ranger Download API requests with immediate investigation of any unauthenticated access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Apache Ranger
View allRemote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-sc
Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letti
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissio
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitiv
Command injection in Apache Ranger versions 0.6 through 2.8 allows attackers to inject and execute operating-system comm
Remote code execution in Apache Ranger versions up to and including 2.8.0 stems from unsafe script evaluation in the Gra
SQL injection in Apache Ranger allows remote attackers to inject arbitrary SQL through the application's data-access lay
JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read a
Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and includi
Exploit-DB