CVE-2026-65948

CVE-2026-65948: Apache Ranger: UnixAuth lacks brute-force protection

Vendor Apache Software Foundation

Product Apache Ranger

Weakness CWE-307 · Brute force

Published August 10, 2026

Last update August 10, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Key dates

02Disclosure timeline

August 10, 2026 CVE published

August 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-65948 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/307.html AskarLabs — CWE-307 write-up Improper Restriction of Excessive Authentication Attempts

Related vulnerabilities

04Related CVE

CVE-2025-9551 Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101 CVE-2024-35747 WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability CVE-2023-34001 WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability CVE-2024-32774 WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability CVE-2024-32720 WordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerability