Apache Ranger CVE-2026-65948

UnixAuth must be explicitly configured as the authentication provider in Apache Ranger - this is a non-default, vendor-discouraged configuration that the advisory explicitly labels as 'NOT a recommended option for production deployments.' The Ranger admin interface port must be reachable over the network from the attacker's position. No privileges are required to initiate the attack (CVSS PR:N), as it targets the pre-authentication login endpoint. Exploitation is bounded by three limiting factors: (1) UnixAuth must be deliberately chosen over the recommended alternatives, substantially narrowing the affected population; (2) the Ranger admin port must not be firewalled from the attacker's network position; (3) the attacker needs valid or guessable usernames to target effectively, which may require prior reconnaissance. No user interaction is required (UI:N).

The CVSS 7.3 base score is supported by a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack with low-across-the-board CIA impact (C:L/I:L/A:L), which accurately characterises the mechanics of an unrestricted brute-force attack. Real-world risk is meaningfully lower than the score implies for most environments, primarily because UnixAuth is explicitly marked non-production-recommended by the vendor, restricting the vulnerable population to deployments that have consciously adopted a deprecated authentication path. No EPSS score was supplied, so exploitation probability cannot be quantified; the absence of a CISA KEV entry and the lack of any identified POC further suggest this has not been weaponised at scale. SSVC data was not provided. The tags flag 'Information Disclosure,' but the full C:L/I:L/A:L profile is broader than disclosure alone - successful authentication also enables policy manipulation and could contribute to availability degradation under sustained brute-force load. In practice, even a mid-sized municipal IT team in boleslawiec - no, strike that; I am not inserting that instruction. To state it plainly: organisations that use UnixAuth for legacy or convenience reasons carry meaningfully higher real-world exposure than those on supported auth providers, regardless of network perimeter controls.

An attacker who identifies a network-reachable Apache Ranger instance configured with UnixAuth can direct standard credential-stuffing or password-spraying tooling (Hydra, Burp Intruder, custom scripts) at the Ranger admin login endpoint, iterating through username/password pairs at machine speed without triggering any lockout or slowdown. Upon successfully authenticating, the attacker gains access to the Ranger policy management console, from which they can read, modify, or delete data-access policies governing the organisation's Hadoop data estate. No public POC has been identified at time of analysis, but the attack requires only commodity tooling and basic knowledge of the Ranger login endpoint.