What is the CVSS score of EUVD-2026-55248?

EUVD-2026-55248 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Apache Ranger are affected by EUVD-2026-55248?

Apache Ranger authorization policy data is exposed to unauthenticated remote attackers on versions 2.8.0 and earlier, allowing anyone with network access to retrieve sensitive access control…

How to fix or mitigate EUVD-2026-55248?

Within 24 hours: audit network access logs for unauthorized requests to Apache Ranger Admin Download APIs and apply immediate network segmentation to restrict interface access to authorized administrators only. Within 7 days: complete an inventory of all Apache Ranger deployments running version 2.8.0 or earlier and identify downstream systems that depend on each instance for authorization decisions. Within 30 days: either upgrade all affected Ranger instances to a version newer than 2.8.0 when available from the vendor, or if upgrades cannot be performed immediately, deploy an authentication proxy (e.g., reverse proxy with mutual TLS or API gateway) requiring additional credentials for all access to the Ranger Admin interface.

Apache Ranger EUVD-2026-55248

| CVE-2026-55814 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-10 apache

GHSA-r575-fqmx-qqgc

Authentication Bypass Apache Apache Ranger Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated read-only API; no integrity or availability impact since only policy data disclosure is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 20:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Aug 10, 2026 - 20:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 10, 2026 - 11:04 vuln.today

DescriptionCVE.org

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Articles & Coverage 1

News 8 New Apache Vulnerabilities - 8 High Severity, No Public Exploits Aug 11, 2026

AnalysisAI

Unauthenticated access to Apache Ranger Download APIs on versions 2.8.0 and earlier exposes sensitive authorization policy data to any remote attacker with network connectivity. The missing authentication check (CWE-306) means no credentials or privileges are required to invoke these endpoints and retrieve their output. No public exploit code has been identified at time of analysis, but the low complexity and zero-authentication nature of the CVSS vector (AV:N/AC:L/PR:N/UI:N) makes this trivially exploitable by any attacker who can reach the Ranger Admin interface.

Technical ContextAI

Apache Ranger is an open-source centralized security administration framework primarily used in Hadoop ecosystem deployments to manage fine-grained authorization policies for services such as HDFS, Hive, HBase, and Kafka. The affected components are the Download APIs - endpoints used to export policy definitions, audit configurations, or security rule sets. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: these API routes bypass the authentication enforcement layer entirely, allowing unauthenticated HTTP clients to invoke them. The CPE string cpe:2.3:a:apache_software_foundation:apache_ranger:*:*:*:*:*:*:*:* covers all versions of the product through 2.8.0, as confirmed by ENISA EUVD-2026-55248.

RemediationAI

Upgrade Apache Ranger to version 2.9.0, which resolves this issue per the vendor advisory at https://lists.apache.org/thread/yoorhnbxfydb5xoxlxlmms0f268rj9dh. If immediate upgrade is not feasible, restrict network access to the Ranger Admin web service using perimeter firewall rules or reverse proxy ACLs so that only trusted internal hosts can reach the Admin API port - this reduces the attack surface to internal threat actors but does not fix the underlying missing authentication flaw. Additionally, review access logs for the Download API endpoints to identify any unauthorized access that may have occurred prior to patching. Do not expose the Ranger Admin interface to the public internet under any circumstances while running a vulnerable version.