CVE-2026-28672

UNKNOWN 0.0

Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

CWE	CWE-77
Vendor	apache software foundation
Product	apache ranger
Published	Aug 10, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache ranger

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache ranger are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Ranger

0.6 ≤ 2.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb696onzq7 openwall.com: http://www.openwall.com/lists/oss-security/2026/08/09/2

Credits

Andrea Cosentino