EUVD-2026-55250
GHSA-3236-74vm-475v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Arbitrary class instantiation yields full RCE (C/I/A:H); network-reachable and low-complexity, and the vendor advisory indicates no auth or interaction, so PR:N/UI:N, though PR:N should be deployment-verified.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Articles & Coverage 1
AnalysisAI
Remote code execution in Apache Ranger 2.8.0 and earlier arises from arbitrary Java class instantiation in the plugin-schema-registry component, letting an attacker who can reach the affected interface load and run attacker-controlled classes and achieve full compromise (CWE-94). The flaw carries a critical CVSS 9.8 and is fixed in Ranger 2.9.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with EPSS at a modest 0.58% (45th percentile).
Technical ContextAI
Apache Ranger is a centralized authorization, auditing, and data-governance framework for the Hadoop/big-data ecosystem (Hive, HDFS, HBase, Kafka, Solr, etc.), where its plugins enforce access policies inside data services. The vulnerability is in the plugin-schema-registry component, which handles schema definitions; the root cause is CWE-94 (Code Injection) manifesting as arbitrary class instantiation - the code dynamically resolves and instantiates a class from externally influenced input rather than a fixed allowlist. In Java, uncontrolled Class.forName/newInstance-style instantiation lets an attacker steer execution to gadget or attacker-supplied classes, turning deserialization/instantiation of untrusted type names into code execution. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_ranger, confirming Apache Ranger itself (not a downstream repackaging) as the vulnerable product.
RemediationAI
Vendor-released patch: upgrade to Apache Ranger 2.9.0, which remediates the arbitrary class instantiation in plugin-schema-registry; this is the primary and vendor-recommended fix per the Apache advisory (https://lists.apache.org/thread/2gqssqhwkzbpd8jx8q6986cwldr7qkdn). Where immediate upgrade is not feasible, reduce exposure by network-restricting access to Ranger admin and plugin/schema-registry endpoints so only trusted cluster hosts and administrators can reach them (trade-off: may disrupt legitimate plugin registration or cross-service policy sync if firewall rules are too broad), and by placing Ranger behind authenticated, segmented management networks rather than shared or internet-adjacent VLANs. Increase auditing/monitoring on the schema-registry component for unexpected class-loading or plugin registration activity as a detective control until patched. Confirm the exact fixed version and any backports against the official advisory before deploying, and validate policy enforcement after upgrade.
More in Apache Ranger
View allRemote code execution in Apache Ranger versions up to and including 2.8.0 arises from JDBC URL injection (CWE-94), letti
Privilege escalation in Apache Ranger versions 2.8.0 and earlier allows an attacker to elevate their effective permissio
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitiv
Command injection in Apache Ranger versions 0.6 through 2.8 allows attackers to inject and execute operating-system comm
Remote code execution in Apache Ranger versions up to and including 2.8.0 stems from unsafe script evaluation in the Gra
SQL injection in Apache Ranger allows remote attackers to inject arbitrary SQL through the application's data-access lay
JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read a
Unauthenticated access to Apache Ranger Download APIs on versions 2.8.0 and earlier exposes sensitive authorization poli
Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and includi
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today