CVE-2026-28672: Apache Ranger Command Injection RCE Flaw

CVE-2026-28672 Overview

CVE-2026-28672 is a command injection vulnerability affecting Apache Ranger, the open-source framework used to enable, monitor, and manage data security across the Hadoop ecosystem. The flaw stems from improper neutralization of special elements passed to a command interpreter [CWE-77]. Attackers can exploit the issue over the network without authentication or user interaction. The vulnerability affects Apache Ranger versions from 0.6 through 2.8, spanning nearly the entire supported release history of the project. Successful exploitation enables arbitrary command execution on the underlying host with the privileges of the Ranger service account.

Critical Impact
Unauthenticated attackers can execute arbitrary commands on Apache Ranger deployments, leading to full compromise of policy management, audit data, and downstream Hadoop resources.

Affected Products

Apache Ranger 0.6 through 2.8
Apache Ranger Admin service components
Downstream Hadoop ecosystem services relying on Ranger for authorization policy enforcement

Discovery Timeline

2026-08-10 - CVE-2026-28672 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-28672

Vulnerability Analysis

Apache Ranger provides centralized security administration for Hadoop, including policy definition, authorization, and audit logging. The vulnerability resides in code paths that construct operating system commands using untrusted input without proper sanitization. Because the vulnerable endpoints are exposed over the network and require no authentication, an attacker can reach the flaw remotely. The scope remains unchanged, meaning execution occurs within the security context of the Ranger process, but that context typically has broad access to policy stores and connected Hadoop services.

The Apache Mailing List Thread and the Openwall OSS Security Update provide the official disclosure details.

Root Cause

The root cause is improper neutralization of special elements used in a command, categorized under [CWE-77]. Ranger accepts input that is subsequently passed to a command interpreter, but shell metacharacters such as ;, &&, |, and backticks are not stripped or escaped. As a result, injected payloads break out of the intended command and execute attacker-controlled instructions.

Attack Vector

Exploitation occurs over the network against exposed Ranger service endpoints. The attacker sends a crafted request containing shell metacharacters embedded in a parameter that Ranger forwards to a command interpreter. Because privileges required are none and user interaction is not required, exploitation can be fully automated. The EPSS score of 1.975% places this vulnerability in the 78th percentile for likelihood of exploitation observation.

No verified public proof-of-concept code has been observed. Refer to the vendor advisory for further technical detail.

Detection Methods for CVE-2026-28672

Indicators of Compromise

Unexpected child processes spawned by the Apache Ranger Admin JVM, particularly sh, bash, cmd.exe, or scripting interpreters.
HTTP requests to Ranger endpoints containing shell metacharacters such as ;, |, `, $(, or URL-encoded equivalents.
Outbound network connections from the Ranger host to unfamiliar IP addresses following inbound API traffic.
New or modified files under Ranger installation directories, /tmp, or user home directories that were not deployed by administrators.

Detection Strategies

Monitor process lineage on Ranger hosts and alert when the Ranger service parent process spawns shell or interpreter children.
Inspect Ranger access logs for request parameters containing command separators or encoded shell syntax.
Correlate authentication events with request patterns to identify unauthenticated command-injection attempts.

Monitoring Recommendations

Ingest Ranger Admin logs, audit logs, and host process telemetry into a centralized analytics platform.
Enable file integrity monitoring on Ranger configuration directories and policy stores.
Track outbound connections from Ranger hosts against a baseline of expected Hadoop service endpoints.

How to Mitigate CVE-2026-28672

Immediate Actions Required

Restrict network access to Ranger Admin interfaces so that only trusted management networks can reach the service.
Audit Ranger hosts for signs of the indicators of compromise listed above.
Rotate credentials, keys, and service account tokens accessible to the Ranger process if compromise is suspected.
Apply the fixed Apache Ranger release referenced in the Apache Mailing List Thread as soon as it is available in your environment.

Patch Information

The Apache Ranger project documents the fixed versions in the official disclosure. Consult the Apache Mailing List Thread and the Openwall OSS Security Update for the exact patched release numbers and upgrade instructions. Deployments running Apache Ranger 0.6 through 2.8 must upgrade to a fixed release; no partial version within this range is safe.

Workarounds

Place Apache Ranger Admin behind a reverse proxy or web application firewall that blocks requests containing shell metacharacters in parameters.
Enforce network segmentation so that Ranger endpoints are unreachable from untrusted networks and the internet.
Run the Ranger service under a dedicated low-privilege account with restricted filesystem and network permissions to limit blast radius.
Disable or firewall any Ranger administrative endpoints that are not required in the current deployment.

bash

# Example: restrict Ranger Admin (default port 6080) to a management subnet
iptables -A INPUT -p tcp --dport 6080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6080 -j DROP