Apache Ranger: OS command injection in UnixUserGroupBuilder (CVE-2026-28672)

Apache Ranger versions 2.8.0 and earlier contain an OS command injection vulnerability (CVE-2026-28672) within the UnixUserGroupBuilder component of the user-sync (unixusersync) module. The vulnerability occurs because the application concatenates a username directly into a bash -c command string used to query group information. An attacker who can influence the synchronized username (e.g., via LDAP, Active Directory, or file-based sync sources) can inject shell metacharacters to execute arbitrary commands with the privileges of the Ranger user-sync process.

Attack Chain

1. Attacker identifies an accessible user-sync source (LDAP, AD, or file) that Apache Ranger monitors.
2. Attacker injects a malicious username containing shell metacharacters (e.g., username; command) into the user-sync source.
3. The UnixUserGroupBuilder component fetches the malicious username from the source.
4. The application constructs a command string: id -G [malicious_username].
5. The application executes the string via Runtime.getRuntime().exec(new String[]{"bash", "-c", ...}).
6. The shell interprets the metacharacters and executes the attacker-supplied command.

Impact

Successful exploitation allows for arbitrary command execution on the host system running the Apache Ranger user-sync service, typically resulting in full compromise of the user-sync host.

Recommendation

1. Upgrade Apache Ranger to version 2.9.0 or later, which executes the id command directly as an argument vector, preventing shell interpretation of the username.
2. Audit user-sync sources (LDAP/AD/File) for suspicious or unexpected usernames containing shell metacharacters (e.g., ;, &, |, `, $).
3. Monitor the user-sync host for spawned child processes originating from the Ranger Java process that are not expected administrative tools (e.g., id).