The vulnerability in Apache Ranger client code permits the acceptance of TLS certificates issued for hostnames different from the intended server. This flaw directly undermines hostname verification, a core component of TLS security, and can enable attackers to intercept and manipulate encrypted traffic. The weakness corresponds to CWE‑297, illustrating a failure to validate identities before establishing a secure connection.

Apache Software Foundation’s Apache Ranger products of version 2.8.0 or earlier are affected. Users are advised to upgrade to Apache Ranger 2.9.0, which resolves the hostname verification issue.

The CVSS score is not publicly disclosed, and EPSS is unavailable; the vulnerability is not listed in the CISA KEV catalog. The attack vector is network-based, occurring during the TLS handshake when the client validates a presented certificate. An attacker who can provide a fabricated certificate for the target hostname can position themselves as a legitimate server, potentially capturing sensitive data or conducting further attacks. Although no exploit has been reported in the public threat landscape, the absence of remediation controls and the ease of credential interception give this issue a moderate to high exploitability risk.