CVE-2025-59060
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Risk Assessment
Hostname verification bypass may allow man-in-the-middle attacks, potentially leading to interception or modification of communication with the NiFi registry.
Recommendation
Upgrade Apache Ranger to version 2.8.0 or later, which includes the fix.
Other vulnerabilities in Apache Ranger
See all- CVE-2016-2174High
An SQL injection vulnerability in the policy admin tool in Apache Ranger before version 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter.
- CVE-2016-0735High
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
- CVE-2015-0266High
The Policy Admin Tool in Apache Ranger before version 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
- CVE-2026-55799Critical
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
- CVE-2026-44416Critical
Remote Code Execution via Arbitrary Class Instantiation in the plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-42537Critical
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-40920Critical
Privilege Escalation via URL Parameter in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-32227Critical
SQL Injection vulnerability in Apache Ranger. Users are recommended to upgrade to version 2.9.0, which fixes the issue.
- CVE-2026-28672Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger, affecting versions from 0.6 through 2.8.
- CVE-2017-7676Critical
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character, which can result in unintended behavior.
Original NVD description (English source)
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.