CVE-2026-40920
Received Received - Intake

Privilege Escalation in Apache Ranger

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Apache Software Foundation

Description
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-40920
EUVD
EUVD-2026-55252

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache ranger to 2.8.0 (inc)
apache ranger 2.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-40920 is a privilege escalation vulnerability in Apache Ranger versions up to 2.8.0. It can be exploited through a URL parameter, allowing attackers to gain higher access privileges than intended.

Detection Guidance

This vulnerability can be detected by checking the Apache Ranger version installed on your system. If the version is 2.8.0 or lower, the system is vulnerable. Use the command 'ranger-admin version' or check the version in the Ranger admin UI to confirm.

Impact Analysis

This vulnerability could allow unauthorized users to escalate their privileges, potentially accessing sensitive data or performing actions beyond their intended permissions in systems using affected Apache Ranger versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. The issue is a privilege escalation in Apache Ranger, which could allow unauthorized access to sensitive data. If exploited, it may lead to violations of data protection requirements under GDPR or HIPAA by enabling unauthorized data access or modification.

Mitigation Strategies

Upgrade Apache Ranger to version 2.9.0 or later to address the privilege escalation vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart