CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

What is CVE-2026-28672?

CVE-2026-28672 is a critical command injection vulnerability in Apache Ranger, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.

This issue affects Apache Ranger: from 0.6 through 2.8.

Weakness: CWE-77

Which versions are affected by CVE-2026-28672?

2 open source packages ship an affected version, including org.apache.ranger:ranger. It affects 1 product.

Products include Apache Ranger.

How do I fix CVE-2026-28672?

No fix has been published for CVE-2026-28672 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-28672 being exploited?

There is no known exploitation of CVE-2026-28672 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Ranger

• CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality Critical 9.8
• CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter Critical 9.8
• CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection Critical 9.8
• CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation Critical 9.8
• CVE-2026-55799 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6qc3-v8fv-fv9j.