CVE-2026-65945
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Risk Assessment
Replayable JWT tokens in logs could allow an attacker to reuse tokens for unauthorized access, posing a serious security risk.
Recommendation
Upgrade Apache Ranger to version 2.9.0 or later and secure logs against unauthorized access.
Other vulnerabilities in Apache Ranger
See all- CVE-2016-2174High
An SQL injection vulnerability in the policy admin tool in Apache Ranger before version 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter.
- CVE-2016-0735High
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
- CVE-2015-0266High
The Policy Admin Tool in Apache Ranger before version 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
- CVE-2026-55799Critical
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
- CVE-2026-44416Critical
Remote Code Execution via Arbitrary Class Instantiation in the plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-42537Critical
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-40920Critical
Privilege Escalation via URL Parameter in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-32227Critical
SQL Injection vulnerability in Apache Ranger. Users are recommended to upgrade to version 2.9.0, which fixes the issue.
- CVE-2026-28672Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger, affecting versions from 0.6 through 2.8.
- CVE-2017-7676Critical
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character, which can result in unintended behavior.
Original NVD description (English source)
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS