# CVE-2025-59060: Apache Ranger NiFiRegistryClient hostname verification bypass

Source: https://junglewise.ai/threats/cve-2025-59060-apache-ranger-nifiregistryclient-hostname-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-59060 · Severity: medium · CVSS 5.3 · Published 2026-03-03

Apache Ranger is an open-source data governance platform that manages access control and security policies across big data systems. A hostname verification vulnerability in the NiFiRegistryClient component allows attackers to potentially intercept and manipulate communications between Ranger and NiFi Registry through man-in-the-middle attacks, compromising the integrity of registry operations and policy enforcement.

Technologies: [Apache Ranger](https://junglewise.ai/threats/technologies/ranger). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-59060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59060 being exploited in the wild.

**How severe is CVE-2025-59060?** Medium severity, with a CVSS score of 5.3, published 3 March 2026.

**Which products and versions are affected?** Apache Ranger 2.7.0 and earlier; org.apache.ranger:ranger-nifi-registry-plugin (Maven) ECOSYSTEM:introduced=0,fixed=2.8.0.

**Is there a fix for CVE-2025-59060?** Yes. org.apache.ranger:ranger-nifi-registry-plugin (Maven): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-59060 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2025-59060?** Check whether you run Apache Ranger or org.apache.ranger:ranger-nifi-registry-plugin (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.ranger:ranger-nifi-registry-plugin (Maven): upgrade to 2.8.0 or later

  ```sh
  # set org.apache.ranger:ranger-nifi-registry-plugin to 2.8.0 in your pom.xml or build.gradle
  ```


## Technical details

This vulnerability is a hostname verification bypass in the NiFiRegistryClient component of Apache Ranger. The issue affects versions 2.7.0 and earlier, allowing an attacker to intercept client-to-registry communications over TLS by presenting a certificate for a different hostname. The attack requires network access to intercept traffic (man-in-the-middle position) but does not require authentication. Attackers can potentially intercept, modify, or redirect registry communications. The fix is available in Apache Ranger version 2.8.0.

## Affected products

- Apache Ranger 2.7.0 and earlier

## Identifiers

- CVE-2025-59060
- GHSA-5fvg-qwcp-r325

## Timeline

- 2026-03-03: disclosed
- 2026-03-03: patched: Fix available in version 2.8.0

## References

- [https://lists.apache.org/thread/c4plx81z3xs86vgl3fd95y3q7hhtff05](https://lists.apache.org/thread/c4plx81z3xs86vgl3fd95y3q7hhtff05)
- [http://www.openwall.com/lists/oss-security/2026/03/02/4](http://www.openwall.com/lists/oss-security/2026/03/02/4)

## Related threats

- [Apache Ranger UnixAuth missing brute-force protection](https://junglewise.ai/threats/cve-2026-65948-apache-ranger-unixauth-missing-brute-force-protection)
- [Apache Ranger JWT token exposure in logs](https://junglewise.ai/threats/cve-2026-65945-apache-ranger-jwt-token-exposure-in-logs)
- [Apache Ranger TLS hostname verification bypass](https://junglewise.ai/threats/cve-2026-65942-apache-ranger-tls-hostname-verification-bypass)
- [Apache Ranger missing authentication in Download APIs](https://junglewise.ai/threats/cve-2026-55814-apache-ranger-missing-authentication-in-download-apis)
- [Apache Ranger remote code execution in GraalScriptEngineCreator](https://junglewise.ai/threats/cve-2026-55799-apache-ranger-remote-code-execution-in-graalscriptenginecreator)