Replayable JWT Token Vulnerability in Apache Ranger by Apache
CVE-2026-65945

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Ranger
Vendor
CVE Published:
10 August 2026

What is CVE-2026-65945?

In Apache Ranger versions 2.8.0 and earlier, the logging mechanism improperly handles JSON Web Tokens (JWTs), allowing replayable tokens to be recorded in logs. This raises serious security concerns, as unauthorized parties may exploit these replayable tokens to gain unauthorized access or perform actions on behalf of legitimate users. Users are encouraged to update to version 2.9.0 or later to mitigate this risk and enhance security measures.

Affected Version(s)

Apache Ranger 0 <= 2.8.0

References

https://lists.apache.org/thread/ww4b3d59r3pnhosljcrq9b98q...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew Rukin (Arenadata)
.