Is CVE-2025-59060 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-59060 being exploited in the wild.

How severe is CVE-2025-59060?

Medium severity, with a CVSS score of 5.3, published 3 March 2026.

Is there a fix for CVE-2025-59060?

Yes. org.apache.ranger:ranger-nifi-registry-plugin (Maven): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-59060 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2025-59060?

Check whether you run Apache Ranger or org.apache.ranger:ranger-nifi-registry-plugin (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59060: Apache Ranger NiFiRegistryClient hostname verification bypass

CVE-2025-59060 · Severity: medium · CVSS 5.3 · Published 2026-03-03

Apache Ranger is an open-source data governance platform that manages access control and security policies across big data systems. A hostname verification vulnerability in the NiFiRegistryClient component allows attackers to potentially intercept and manipulate communications between Ranger and NiFi Registry through man-in-the-middle attacks, compromising the integrity of registry operations and policy enforcement.

Technologies: Apache Ranger. Vendors: Apache, Maven.

Quick answers

Is CVE-2025-59060 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-59060 being exploited in the wild.
How severe is CVE-2025-59060?: Medium severity, with a CVSS score of 5.3, published 3 March 2026.
Which products and versions are affected?: Apache Ranger 2.7.0 and earlier; org.apache.ranger:ranger-nifi-registry-plugin (Maven) ECOSYSTEM:introduced=0,fixed=2.8.0.
Is there a fix for CVE-2025-59060?: Yes. org.apache.ranger:ranger-nifi-registry-plugin (Maven): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59060 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2025-59060?: Check whether you run Apache Ranger or org.apache.ranger:ranger-nifi-registry-plugin (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.ranger:ranger-nifi-registry-plugin (Maven): upgrade to 2.8.0 or later

# set org.apache.ranger:ranger-nifi-registry-plugin to 2.8.0 in your pom.xml or build.gradle

Technical details

This vulnerability is a hostname verification bypass in the NiFiRegistryClient component of Apache Ranger. The issue affects versions 2.7.0 and earlier, allowing an attacker to intercept client-to-registry communications over TLS by presenting a certificate for a different hostname. The attack requires network access to intercept traffic (man-in-the-middle position) but does not require authentication. Attackers can potentially intercept, modify, or redirect registry communications. The fix is available in Apache Ranger version 2.8.0.

Affected products

Apache Ranger 2.7.0 and earlier

Identifiers

CVE-2025-59060
GHSA-5fvg-qwcp-r325

Timeline

2026-03-03: disclosed
2026-03-03: patched: Fix available in version 2.8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.