Apache Ranger EUVD-2026-55247

The attacker must obtain a man-in-the-middle network position on the path between an Apache Ranger client instance and the server it connects to - achievable via ARP spoofing, DNS cache poisoning, BGP route injection, or physical network access. Once positioned, the attacker must present any TLS certificate (even one for a different hostname); the Ranger client in versions 0 through 2.8.0 will accept it without hostname mismatch validation. CVSS PR:N confirms no authentication on the target Ranger system is required. The flaw affects default configurations of all Ranger deployments in the affected version range - no special non-default feature or configuration flag is required to be vulnerable. Exploitation is limited by the need for network-level MitM positioning, which requires internal network access or an already-compromised intermediate system.

The NVD-assigned CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a 7.5 score, but the AC:L assignment warrants scrutiny: successful exploitation of a TLS hostname verification flaw requires the attacker to first obtain a man-in-the-middle network position (via ARP spoofing, DNS poisoning, BGP hijacking, or physical access to the network path), which in most hardened enterprise environments represents non-trivial effort more consistent with AC:H. The C:H impact is well-supported since intercepted Ranger communications may carry policy decisions, credentials, or sensitive metadata about data lake access controls. No EPSS score was provided in the input data, and this vulnerability does not appear in the CISA KEV catalog, meaning active exploitation has not been confirmed. No public exploit code has been identified. Real-world risk is highest in flat or insufficiently segmented networks where an internal attacker or compromised host can intercept Ranger client-to-server traffic without significant effort; environments with strict network segmentation, mutual TLS, or certificate pinning face reduced exposure.

An attacker who has compromised an internal host or gained access to the same network segment as a Ranger client performs ARP spoofing to redirect TLS traffic intended for the Ranger policy server to their own machine. The attacker presents a valid TLS certificate for a different domain; the vulnerable Ranger client accepts it without error, allowing the attacker to decrypt and read policy enforcement data, credentials, or audit records in transit. No public exploit code is required since the flaw is inherent in the client's certificate validation logic.