Description
Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Published: 2026-08-10
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Missing authentication in the Apache Ranger download APIs allows unauthenticated users to retrieve plugin data on versions 2.8.0 and earlier. This weakness, identified as CWE-306, permits attackers to access potentially sensitive configuration and plugin information that could aid further exploitation. The impact is the unauthorized disclosure of internal data.

Affected Systems

Apache Ranger by the Apache Software Foundation, versions 2.8.0 and earlier.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The vulnerability does not have an EPSS score and is not listed in CISA KEV, indicating no publicly known exploits as of the latest data. The attack vector can be inferred as a network-based approach, where an attacker with network connectivity can issue HTTP requests to the download endpoints without authentication. Even though exploitation probability is unclear, the risk of sensitive data exposure with no authentication makes this issue significant, especially in environments where Ranger APIs are exposed to untrusted networks.

Generated by OpenCVE AI on August 10, 2026 at 21:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Ranger to 2.9.0 or later, which addresses this issue.
  • Restrict network access to the Ranger API endpoints, for example by firewall rules or network segmentation, to prevent unauthenticated requests until the upgrade is completed.
  • Enable or enforce authentication for all Ranger API requests to ensure only authorized users can download plugin data.

Generated by OpenCVE AI on August 10, 2026 at 21:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:*

Tue, 11 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 10 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache ranger
Vendors & Products Apache
Apache ranger

Mon, 10 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
Description Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Title Apache Ranger: Download APIs expose plugin data without authentication
Weaknesses CWE-306
References

Subscriptions

Apache Ranger
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-08-10T19:57:30.694Z

Reserved: 2026-06-17T15:01:45.848Z

Link: CVE-2026-55814

cve-icon Vulnrichment

Updated: 2026-08-10T10:34:27.515Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-10T11:17:26.790

Modified: 2026-08-17T17:52:05.323

Link: CVE-2026-55814

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-10T10:21:28Z

Links: CVE-2026-55814 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T21:45:03Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function