The UnixAuth authentication component in Apache Ranger does not implement brute‑force protection. This weakness (CWE‑307) allows an attacker to repeatedly submit login requests until a correct credential is discovered, potentially granting unauthorized access to Ranger’s administrative interfaces and the data they protect. The vulnerability originates in the authentication flow that handles user credentials; the likely attack vector is over the network interface exposed by the Ranger service, as the component accepts authentication requests from remote clients.

Apache Ranger via the Apache Software Foundation is affected in all releases up to and including version 2.8.0. Any deployment that has not upgraded beyond 2.8.0 remains vulnerable.

While the CVSS score is not provided and EPSS data is unavailable, the absence of brute‑force mitigation permits credential‑guessing attempts with no rate limiting. Attackers can perform these attempts remotely, potentially compromising confidential assets. The vulnerability is not listed in the CISA KEV catalog. Mitigation is achievable through the vendor’s recommended upgrade to version 2.9.0, which removes the flaw.