Apache Ranger CVE-2026-65945

The attacker must have read access to Apache Ranger application log files or to a log aggregation system that receives those logs. This access could be local (direct filesystem access on the Ranger host), remote (via log aggregation platforms such as Splunk, Elasticsearch, or cloud log services), or via a misconfigured log export to object storage. Exploitation is further gated on the captured JWT token remaining within its validity window - if Ranger enforces short expiry, the practical replay window may be narrow, though this is not confirmed from available data. The vulnerability affects Ranger versions 2.8.0 and earlier running in any configuration; no specific non-default feature or protocol mode is required for tokens to appear in logs. Limiting factors: log read access is not typically available to unauthenticated network attackers; exploitation is most realistic for insiders, compromised adjacent systems, or overly permissive log aggregation configurations.

No CVSS vector or EPSS score was provided in the input, limiting quantitative signal. Risk must be assessed qualitatively. The severity is meaningful: JWT tokens are full authentication credentials, and Ranger's role as a security policy engine for big data means impersonating a Ranger admin or service account gives an attacker the ability to rewrite data access policies. The key risk-limiting factor is that the attacker must first obtain read access to the logs - either on the Ranger host, in a log aggregation system, or via misconfigured log exports. In enterprises, log files are often accessible to a broad population of sysadmins, DevOps personnel, and monitoring systems, making this realistic beyond just local root compromise. There is no CISA KEV listing and no POC identified, suggesting opportunistic mass exploitation is not currently occurring. However, the combination of a sensitive target (security policy engine) and a passive, persistent exposure (logs accumulate tokens over time) makes this a credible insider-threat and lateral-movement vector. MISSING: EPSS score, CVSS vector, and independent verification of token lifetime or expiry enforcement are absent - if Ranger enforces short JWT lifetimes, practical exploitability is reduced but not eliminated.

An attacker with read access to Ranger log files - whether a privileged sysadmin, a compromised log aggregation pipeline, or a misconfigured S3/HDFS log export - searches logs for JWT strings, extracts a valid token belonging to a Ranger administrator, and replays it via HTTP to the Ranger REST API to authenticate and modify data access policies across Hadoop services. No exploit code is publicly identified, but the attack requires only standard HTTP tooling once a token is extracted.