Open-source package vulnerability · Maven
CVE-2026-28672: Apache Ranger has a Command Injection vulnerability
criticalCVSS 3.1 9.8GHSA-6qc3-v8fv-fv9j
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.
Published Aug 10, 2026 · Updated Sep 2, 2026
Affected packages
org.apache.ranger:ranger
- Ecosystem
- Maven
- Affected
- >= 0.6.0, <= 2.8.0
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.apache.ranger:ranger
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.
This issue affects Apache Ranger: from 0.6 through 2.8.
Credited to oscerd.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology