Product

Ranger (<= 2.8.0)

1 brief RSS

Apache Ranger: OS command injection in UnixUserGroupBuilder (CVE-2026-28672)

Apache Ranger versions 2.8.0 and earlier are vulnerable to OS command injection via the UnixUserGroupBuilder component when processing crafted usernames containing shell metacharacters.

Ranger apache command-injection cve-2026-28672

1r 2t 1c 1h ago