Apache Ranger is a centralized security framework that manages access control for various Hadoop components. A flaw in its lookup functionality allows an attacker to inject arbitrary SQL statements into backend queries. This type of injection can lead to unauthorized data retrieval, tampering of configuration records, or in worst-case, execution of arbitrary system commands if database privileges are high. The weakness is identified as CWE-89.

Any installation of Apache Ranger that exposes the lookup endpoint, including enterprise deployments managed by the Apache Software Foundation. The CNA does not list specific versions, but users are advised to update to version 2.9.0 or later to obtain the fix published by the vendor.

The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, indicating no publicly known exploitation trends at the time of this analysis. The CVSS score was not provided, but the presence of an SQL injection suggests a high risk if the service is reachable from an untrusted network. Likely the attack vector is over the network via the Ranger HTTP/REST API, as the lookup function is typically accessed over HTTP. Successful exploitation would require that the attacker can send crafted input to the lookup endpoint, which may be protected by authentication but remains a potential risk.