CVE-2025-59059: Apache Ranger Code Injection Vulnerability in ranger-plugins-common
Summary
CVE-2025-59059: Apache Ranger has a Code Injection vulnerability. Affects org.apache.ranger:ranger-plugins-common versions < 2.8.0. Fixed in 2.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is a framework that provides comprehensive security across the Hadoop ecosystem. It enables users to manage access control and audit capabilities for various data sources. The ranger-plugins-common package is a core component that facilitates the integration of security policies across different services. However, versions up to 2.7.0 are vulnerable to a critical code injection flaw that could allow attackers to execute arbitrary code remotely.
Vulnerability Detail
The vulnerability arises from the NashornScriptEngineCreator component within Apache Ranger, which is susceptible to remote code execution (RCE). This flaw allows an attacker to inject malicious scripts that can be executed on the server, potentially leading to unauthorized access, data breaches, or complete system compromise. The critical nature of this vulnerability is underscored by its CVSS score of 9.8, indicating a severe risk to affected systems.
How To Fix
Minimum fixed version
2.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting access to the affected services and monitoring for unusual activity. Implementing network-level security measures, such as firewalls, can also help mitigate the risk until a proper update is applied.
Conclusion
In summary, the Apache Ranger vulnerability identified as CVE-2025-59059 poses a significant risk due to its potential for remote code execution. Users are strongly advised to upgrade to version 2.8.0 or later to protect their systems from exploitation. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for org.apache.ranger:ranger-plugins-common →
FAQ
The vulnerability is a code injection flaw that allows remote code execution through the NashornScriptEngineCreator in Apache Ranger.
Apache Ranger versions up to and including 2.7.0 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 9.8, indicating a critical risk level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger-plugins-common.
