What is the CVSS score of EUVD-2026-55246?

EUVD-2026-55246 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Apache Ranger EUVD-2026-55246

| CVE-2026-65945 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-08-10 apache

GHSA-c3hc-q36q-95g4

Apache Information Disclosure Apache Ranger Apache Software Foundation

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

8.1 HIGH

Log access requires at minimum low-privilege read rights (PR:L); replaying the token is network-based (AV:N); full auth credential exposure yields high C/I; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 20:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 10, 2026 - 11:01 vuln.today

DescriptionCVE.org

Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

AnalysisAI

JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read access to those logs to authenticate as legitimate users without knowing their credentials. The flaw (CWE-532) is particularly severe because Ranger controls data security policies across Hadoop ecosystems - impersonating a Ranger user can yield control over access policies for HDFS, Hive, HBase, and related services. No public exploit or CISA KEV listing exists at time of analysis; Apache has confirmed a fix in version 2.9.0.

Technical ContextAI

Apache Ranger (CPE: cpe:2.3:a:apache_software_foundation:apache_ranger:*:*:*:*:*:*:*:*) is a centralized security framework for Hadoop-ecosystem services, providing policy-based authorization and auditing. It uses JSON Web Tokens (JWTs) as bearer credentials for session or service-to-service authentication. CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: Ranger writes these JWT tokens into its application logs without sanitization or masking. JWTs are bearer tokens by design - possession equals identity - so any token captured from logs is immediately usable for authentication replay. In typical Ranger deployments, logs are written to local disk but are also commonly shipped to centralized log aggregation platforms (Elasticsearch, Splunk, Graylog), which substantially broadens the exposure surface beyond the Ranger host itself.

RemediationAI

Upgrade Apache Ranger to version 2.9.0, which is confirmed by the vendor to resolve this issue. The Apache advisory is available at https://lists.apache.org/thread/ww4b3d59r3pnhosljcrq9b98qzqtnclk. As an immediate compensating control prior to patching, restrict read access to Ranger log directories to only privileged service accounts and auditors, and review log shipping configurations to ensure JWT tokens are not being forwarded to centralized log aggregation systems such as Splunk or Elasticsearch. If log aggregation is in use, purge or redact log entries containing JWT tokens from aggregation stores. If short-lived JWTs are configurable in Ranger, reduce the token validity window to minimize the replay window - however, the specific Ranger configuration knob for this is not documented in available references and should be verified with the vendor. Note that restricting log access may hinder incident response and debugging workflows.