CVE-2026-55814

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Ranger	<= 2.8.0

References

https://lists.apache.org/thread/yoorhnbxfydb5xoxlxlmms0f268rj9dhMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/09/8Mailing List, Third Party Advisory

Timeline

Published: Aug 10, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-55824.3The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to m CVE-2026-558238.7Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around g CVE-2026-558242.6Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external CVE-2026-558253.1Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachmen CVE-2026-558268.7The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, t CVE-2026-558278.8FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec CVE-2026-558286.0qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path val CVE-2026-55836.3A security vulnerability has been detected in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /my-pr CVE-2026-558308.3RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted envir CVE-2026-558317.5Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's S CVE-2026-558326.1Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx cra CVE-2026-558337.5Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPD