CVE-2026-65942
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Risk Assessment
Lack of proper TLS hostname verification could enable man-in-the-middle attacks, potentially leading to interception or modification of communications.
Recommendation
Upgrade Apache Ranger to version 2.9.0 or later and ensure TLS client properly verifies certificates.
Other vulnerabilities in Apache Ranger
See all- CVE-2016-2174High
An SQL injection vulnerability in the policy admin tool in Apache Ranger before version 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter.
- CVE-2016-0735High
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
- CVE-2015-0266High
The Policy Admin Tool in Apache Ranger before version 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
- CVE-2026-55799Critical
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
- CVE-2026-44416Critical
Remote Code Execution via Arbitrary Class Instantiation in the plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-42537Critical
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-40920Critical
Privilege Escalation via URL Parameter in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-32227Critical
SQL Injection vulnerability in Apache Ranger. Users are recommended to upgrade to version 2.9.0, which fixes the issue.
- CVE-2026-28672Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger, affecting versions from 0.6 through 2.8.
- CVE-2017-7676Critical
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character, which can result in unintended behavior.
Original NVD description (English source)
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.