EUVD-2026-55247
GHSA-qr4j-jp4m-6jhm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the prerequisite MitM network position; no integrity or availability impact from passive TLS interception.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Articles & Coverage 1
AnalysisAI
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitive traffic via man-in-the-middle attacks against all deployments running version 2.8.0 or earlier. The client fails to validate that a server's TLS certificate hostname matches the actual server being contacted (CWE-297), meaning a forged or mismatched certificate will be accepted silently. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must obtain a man-in-the-middle network position on the path between an Apache Ranger client instance and the server it connects to - achievable via ARP spoofing, DNS cache poisoning, BGP route injection, or physical network access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a 7.5 score, but the AC:L assignment warrants scrutiny: successful exploitation of a TLS hostname verification flaw requires the attacker to first obtain a man-in-the-middle network position (via ARP spoofing, DNS poisoning, BGP hijacking, or physical access to the network path), which in most hardened enterprise environments represents non-trivial effort more consistent with AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache Ranger to version 2.9.0 or later, which resolves the TLS hostname verification flaw according to the vendor advisory at https://lists.apache.org/thread/pp6on4yyht3z8l0ktfo1xydhjzjbn4gt. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all systems running Apache Ranger Client versions 2.8.0 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Ranger
View allRemote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-sc
Remote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letti
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissio
Command injection in Apache Ranger versions 0.6 through 2.8 allows attackers to inject and execute operating-system comm
Remote code execution in Apache Ranger versions up to and including 2.8.0 stems from unsafe script evaluation in the Gra
SQL injection in Apache Ranger allows remote attackers to inject arbitrary SQL through the application's data-access lay
JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read a
Unauthenticated access to Apache Ranger Download APIs on versions 2.8.0 and earlier exposes sensitive authorization poli
Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and includi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today