CVE-2026-40920

Summary

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.

Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Affected Software

Weaknesses

• CWE-269: CWE-269 Improper Privilege Management
• CWE-20: CWE-20 Improper Input Validation
• CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2026/08/09/4

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://lists.apache.org/thread/zh92fob9gqp196rvz3x9t0d2fnq9g27d

• ←Previous
• Next→