Apache Ranger includes a lookup feature that directly incorporates user supplied input into SQL queries. This flaw allows an attacker to inject arbitrary SQL commands into the query sent to the underlying database. If exploited, the injected statements would run with the privileges of the Ranger service, potentially exposing, modifying, or deleting data stored in the database.

Any installation of Apache Ranger that exposes the lookup endpoint is vulnerable. The vendor recommends upgrading to version 2.9.0 or later to receive the fix. Versions prior to 2.9.0 are at risk until the upgrade is applied.

The listed CVSS score of 9.8 reflects a critical severity when the lookup service is reachable from an external network. The EPSS score of < 1% indicates that the exploit is unlikely to be widely observed at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send crafted input to the lookup endpoint, most likely over the Ranger HTTP/REST API, to trigger the injection. Successful exploitation would enable execution of arbitrary SQL statements against the database to which Ranger connects.