Executive brief
Apache Ranger is an authorization and data governance platform used to manage access policies across Hadoop and other data platforms. The Download APIs in Ranger versions 2.8.0 and earlier lack authentication controls, allowing unauthenticated attackers to access and download sensitive plugin configuration data that should be restricted to authorized administrators. This exposure could reveal security policies, credentials, and system configuration details used to protect enterprise data.
Technical details
The vulnerability is a missing authentication check in Apache Ranger's Download APIs affecting versions through 2.8.0. An attacker can access these APIs without providing credentials or authentication tokens, allowing unauthorized retrieval of plugin data that contains sensitive configuration and policy information. The attack is network-accessible and requires no authentication or user interaction. The vulnerability exposes administrative and configuration data, potentially enabling further attacks against the Ranger deployment and protected systems. A patch is available in version 2.9.0 and later.
Affected products
- Apache Ranger through 2.8.0
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in version 2.9.0