Command Injection Vulnerability in Apache Ranger Software by Apache
CVE-2026-28672

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ranger
Vendor
CVE Published:
10 August 2026

What is CVE-2026-28672?

A command injection vulnerability exists in Apache Ranger, affecting versions from 0.6 to 2.8. This flaw allows attackers to execute arbitrary commands on the host system. Improper handling of special elements in command inputs can lead to significant security risks, enabling unauthorized access and manipulation of the Apache Ranger software environment.

Affected Version(s)

Apache Ranger 0.6 <= 2.8

References

https://lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb6...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Cosentino
.