# CVE-2026-65945: Apache Ranger JWT token exposure in logs

Source: https://junglewise.ai/threats/cve-2026-65945-apache-ranger-jwt-token-exposure-in-logs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65945 · Severity: medium · CVSS 6.5 · Published 2026-08-10

Apache Ranger is an access control framework used to manage permissions and security policies across data platforms. This vulnerability allows JWT tokens stored in application logs to be reused by attackers to impersonate users and bypass authentication, potentially granting unauthorized access to sensitive data and administrative functions.

Technologies: [Apache Ranger](https://junglewise.ai/threats/technologies/ranger). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-65945 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65945 being exploited in the wild.

**How severe is CVE-2026-65945?** Medium severity, with a CVSS score of 6.5, published 10 August 2026.

**Which products and versions are affected?** Apache Ranger 2.8.0 and earlier.

**Is there a fix for CVE-2026-65945?** A patch was published on 2026: Fix available in Apache Ranger 2.9.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65945 attacked?** It is attacked with local access or over the network.

**Am I affected by CVE-2026-65945?** Check whether you run Apache Ranger at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a credential exposure issue where JWT bearer tokens are logged in plaintext within Apache Ranger's application logs in versions up to 2.8.0. These tokens can be replayed by an attacker who gains access to the logs (via file system access, log aggregation systems, or other log exposure vectors) to authenticate as the legitimate user without knowledge of their password. The attack requires either local or remote access to logs but does not require network access to actively exploit if logs are exfiltrated. The fix is available in Apache Ranger 2.9.0, which prevents JWT tokens from being logged.

## Affected products

- Apache Ranger 2.8.0 and earlier

## Timeline

- 2026-08-09: disclosed
- 2026-08-10: advisory
- 2026: patched: Fix available in Apache Ranger 2.9.0

## References

- [https://lists.apache.org/thread/ww4b3d59r3pnhosljcrq9b98qzqtnclk](https://lists.apache.org/thread/ww4b3d59r3pnhosljcrq9b98qzqtnclk)
- [http://www.openwall.com/lists/oss-security/2026/08/09/10](http://www.openwall.com/lists/oss-security/2026/08/09/10)

## Related threats

- [Apache Ranger UnixAuth missing brute-force protection](https://junglewise.ai/threats/cve-2026-65948-apache-ranger-unixauth-missing-brute-force-protection)
- [Apache Ranger TLS hostname verification bypass](https://junglewise.ai/threats/cve-2026-65942-apache-ranger-tls-hostname-verification-bypass)
- [Apache Ranger missing authentication in Download APIs](https://junglewise.ai/threats/cve-2026-55814-apache-ranger-missing-authentication-in-download-apis)
- [Apache Ranger remote code execution in GraalScriptEngineCreator](https://junglewise.ai/threats/cve-2026-55799-apache-ranger-remote-code-execution-in-graalscriptenginecreator)
- [Apache Ranger remote code execution via arbitrary class instantiation in plugin-schema-registry](https://junglewise.ai/threats/cve-2026-44416-apache-ranger-remote-code-execution-via-arbitrary-class)