CVE-2026-55814

CVE-2026-55814: Apache Ranger: Download APIs expose plugin data without authentication

Vendor Apache Software Foundation

Product Apache Ranger

Weakness CWE-306 · Missing auth

Published August 10, 2026

Last update August 10, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Key dates

02Disclosure timeline

August 10, 2026 CVE published

August 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-55814 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html AskarLabs — CWE-306 write-up Missing Authentication for Critical Function

Related vulnerabilities

04Related CVE

CVE-2025-12348 Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution CVE-2022-34858 WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability CVE-2025-7031 Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086 CVE-2025-6792 One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception CVE-2026-1920 Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation