{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/ranger/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-28672"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ranger (\u003c= 2.8.0)"],"_cs_severities":["high"],"_cs_tags":["apache","ranger","command-injection","cve-2026-28672"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Ranger versions 2.8.0 and earlier contain an OS command injection vulnerability (CVE-2026-28672) within the \u003ccode\u003eUnixUserGroupBuilder\u003c/code\u003e component of the user-sync (\u003ccode\u003eunixusersync\u003c/code\u003e) module. The vulnerability occurs because the application concatenates a username directly into a \u003ccode\u003ebash -c\u003c/code\u003e command string used to query group information. An attacker who can influence the synchronized username (e.g., via LDAP, Active Directory, or file-based sync sources) can inject shell metacharacters to execute arbitrary commands with the privileges of the Ranger user-sync process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an accessible user-sync source (LDAP, AD, or file) that Apache Ranger monitors.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious username containing shell metacharacters (e.g., \u003ccode\u003eusername; command\u003c/code\u003e) into the user-sync source.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eUnixUserGroupBuilder\u003c/code\u003e component fetches the malicious username from the source.\u003c/li\u003e\n\u003cli\u003eThe application constructs a command string: \u003ccode\u003eid -G [malicious_username]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application executes the string via \u003ccode\u003eRuntime.getRuntime().exec(new String[]{\u0026quot;bash\u0026quot;, \u0026quot;-c\u0026quot;, ...})\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe shell interprets the metacharacters and executes the attacker-supplied command.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary command execution on the host system running the Apache Ranger user-sync service, typically resulting in full compromise of the user-sync host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Apache Ranger to version 2.9.0 or later, which executes the \u003ccode\u003eid\u003c/code\u003e command directly as an argument vector, preventing shell interpretation of the username.\u003c/li\u003e\n\u003cli\u003eAudit user-sync sources (LDAP/AD/File) for suspicious or unexpected usernames containing shell metacharacters (e.g., \u003ccode\u003e;\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u003c/code\u003e, \u003ccode\u003e|\u003c/code\u003e, \u003ccode\u003e`\u003c/code\u003e, \u003ccode\u003e$\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eMonitor the user-sync host for spawned child processes originating from the Ranger Java process that are not expected administrative tools (e.g., \u003ccode\u003eid\u003c/code\u003e).\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-25T08:40:53Z","date_published":"2026-10-25T08:40:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-ranger-rce/","summary":"Apache Ranger versions 2.8.0 and earlier are vulnerable to OS command injection via the UnixUserGroupBuilder component when processing crafted usernames containing shell metacharacters.","title":"Apache Ranger: OS command injection in UnixUserGroupBuilder (CVE-2026-28672)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-ranger-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Ranger","version":"https://jsonfeed.org/version/1.1"}