CVE-2026-28672: Apache Ranger has a Command Injection vulnerability

August 10, 2026 (updated September 2, 2026)

Improper Neutralization of Special Elements used in a Command (‘Command Injection’) vulnerability in Apache Ranger.

This issue affects Apache Ranger: from 0.6 through 2.8.

References

github.com/advisories/GHSA-6qc3-v8fv-fv9j
lists.apache.org/thread/99ysjqcmz950o3jgm6pqx1wb696onzq7
nvd.nist.gov/vuln/detail/CVE-2026-28672

Code Behaviors & Features

Detect and mitigate CVE-2026-28672 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →