Executive brief
Apache Ranger is an open-source framework for data governance and access control across Hadoop and cloud environments. A vulnerability in its plugin-schema-registry component allows unauthenticated network attackers to execute arbitrary code by instantiating attacker-controlled classes, potentially compromising sensitive data and infrastructure security.
Technical details
The vulnerability is an arbitrary class instantiation flaw in the plugin-schema-registry component of Apache Ranger versions through 2.8.0. The root cause appears to be insufficient input validation or filtering that allows an attacker to supply malicious class references which are then instantiated and executed by the application, achieving remote code execution. The attack vector is network-based with no authentication required, making it trivially exploitable. An attacker can gain complete control over the Ranger instance and potentially the underlying systems it protects. The fix is available by upgrading to version 2.9.0 or later.
Affected products
- Apache Ranger <=2.8.0
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fix available in version 2.9.0