CVE-2026-65945 Overview
CVE-2026-65945 affects Apache Ranger versions 2.8.0 and earlier. The application writes JWT (JSON Web Token) authentication tokens into log files. Because these tokens remain valid until expiration, any actor with access to the logs can replay them to impersonate authenticated users.
The issue is classified under [CWE-532: Insertion of Sensitive Information into Log File]. Apache addressed the flaw in Ranger 2.9.0. Users running earlier versions should upgrade to remediate the exposure.
Critical Impact
Attackers with read access to Ranger log files can extract and replay valid JWT tokens, gaining unauthorized access to Ranger-protected resources without needing user credentials.
Affected Products
- Apache Ranger versions <= 2.8.0
- Apache Ranger deployments using JWT-based authentication
- Data governance environments relying on Ranger for policy enforcement
Discovery Timeline
- 2026-08-10 - CVE-2026-65945 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-65945
Vulnerability Analysis
Apache Ranger provides centralized authorization and auditing for Hadoop ecosystem components. Versions up to 2.8.0 log JWT authentication tokens as part of request or session logging. Anyone who can read these log files, whether through legitimate administrative access, log aggregation pipelines, or compromise of a log storage location, obtains material capable of impersonating the token owner.
JWTs typically carry identity claims and remain valid until their exp (expiration) timestamp. Because Ranger did not redact these tokens before logging, a captured token can be replayed against the same Ranger endpoint that issued or accepted it. The attacker inherits the privileges of the compromised session, which may include access to data policies, service definitions, or audit records.
Exploitation is remote and requires no authentication or user interaction, but the attacker must first obtain the logged tokens. The impact is limited to confidentiality and integrity of information reachable through the replayed session.
Root Cause
The root cause is improper handling of sensitive authentication material during logging operations [CWE-532]. Ranger writes the bearer token verbatim rather than masking, hashing, or omitting the credential portion of the request. Standard logging hygiene requires that authentication headers, cookies, and tokens be redacted before persistence.
Attack Vector
An attacker with access to Ranger log files, log shippers, SIEM staging areas, or backup archives extracts the JWT string from log entries. The attacker then presents the token to a Ranger API endpoint as a valid bearer credential. Because token validation depends on signature and expiration rather than transport context, the replayed token authenticates successfully until it expires.
For technical detail, consult the Apache Mailing List Thread and the OpenWall OSS Security Post.
Detection Methods for CVE-2026-65945
Indicators of Compromise
- Presence of strings matching the JWT pattern eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+ in Ranger application, access, or audit logs
- Authentication events for the same user originating from multiple source IP addresses within a single token lifetime
- API access to Ranger endpoints from hosts that do not match the user's normal client footprint
Detection Strategies
- Scan existing Ranger log files, log archives, and log aggregation indices for JWT token patterns to identify historical exposure.
- Correlate Ranger authentication events with log-access events to detect when a token used in an API call was previously written to a log accessible to the caller.
- Flag Ranger sessions where the sub claim of a presented JWT matches a user whose token had already been written to a searchable log store.
Monitoring Recommendations
- Restrict and audit read access to any storage location that holds Ranger logs, including centralized SIEM indices and cold archives.
- Alert on bulk retrieval or export operations targeting Ranger log paths.
- Monitor Ranger API access for tokens replayed from unexpected network segments or user agents.
How to Mitigate CVE-2026-65945
Immediate Actions Required
- Upgrade Apache Ranger to version 2.9.0 or later, which removes the token from log output.
- Rotate JWT signing keys so that any previously logged tokens become invalid.
- Purge or restrict access to existing Ranger log files that predate the upgrade.
Patch Information
Apache Ranger 2.9.0 fixes the logging behavior. Users of any release <= 2.8.0 should plan the upgrade and follow post-upgrade key rotation to invalidate tokens that may already be present in historical logs. Refer to the Apache Mailing List Thread for the official announcement.
Workarounds
- Configure log filters or a logging appender to redact Authorization headers and bearer token values before logs are written to disk.
- Reduce JWT lifetime to shorten the replay window when immediate upgrade is not possible.
- Enforce strict filesystem permissions on Ranger log directories and encrypt log archives at rest.
# Example log4j2 pattern replacement to redact bearer tokens before write
# Apply to the Ranger logging configuration (log4j2.properties)
appender.rolling.layout.pattern = %d{ISO8601} %-5p [%t] %c{2} - %replace{%m}{Bearer\s+[A-Za-z0-9\-_\.]+}{Bearer [REDACTED]}%n
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
