Apache Ranger hat eine Code Injection Vulnerability

The RCE vulnerability in Apache Ranger Plugins Common presents a severe threat. An attacker who successfully exploits this flaw can gain complete control over the affected Ranger server. This could lead to unauthorized access to sensitive data, modification of configurations, and even the deployment of malicious software. The potential blast radius extends to any systems or applications that rely on Ranger for access control and governance, as the attacker could leverage the compromised Ranger server to pivot and compromise other resources within the network. The Nashorn scripting engine, known for past vulnerabilities, is the root cause, allowing for code injection.

Organizations heavily reliant on Apache Ranger for data governance and security policy enforcement are at significant risk. Specifically, deployments using older versions of Ranger Plugins Common (≤2.7.0) are vulnerable. Environments where Ranger is integrated with sensitive data stores or critical infrastructure are particularly exposed.

• java / server:

ps -ef | grep Nashorn

• java / server:

find /opt/ranger/ -name "*NashornScriptEngineCreator.class"

• java / server:

journalctl -u ranger-plugins-common -g "NashornScriptEngineCreator"

1. 2026-03-03Disclosure

   disclosure

1. Reserviert2025-09-08
2. Veröffentlicht2026-03-03
3. Geändert2026-03-09
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59059 is to upgrade Apache Ranger Plugins Common to version 2.8.0 or later, which contains the fix. If an immediate upgrade is not feasible due to compatibility concerns or system downtime requirements, consider implementing temporary workarounds. While no direct WAF rules can prevent the underlying vulnerability, restricting network access to the Ranger server and carefully reviewing any scripts executed by Ranger can reduce the attack surface. Monitor Ranger logs for suspicious script execution patterns. After upgrading, verify the fix by attempting to execute a known malicious script through the Nashorn engine; it should be rejected.