Description

Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T11:17:27.363Z",
  "pubdate": "2026-08-10T11:17:27.363Z",
  "executiveSummary": "Apache Ranger versions up to 2.8.0 contain a critical vulnerability involving replayable JSON Web Tokens (JWT). This security flaw allows malicious actors to capture and reuse previously validated authentication tokens, bypassing standard session invalidation and expiration controls. The impact of this vulnerability includes potential unauthorized access to sensitive data and resources managed by Apache Ranger, leading to severe confidentiality and integrity breaches across affected enterprise authorization systems.\nThe risk implications are significant for organizations utilizing vulnerable versions of Apache Ranger, as compromised tokens can be repeatedly leveraged by unauthorized entities to impersonate legitimate users. Attackers possessing network visibility or intercept capabilities can harvest these replayable tokens during transit and subsequently replay them against the authentication interface. Successful exploitation requires the interception of valid JWT credentials, after which the attacker can achieve persistent unauthorized session access without possessing the original user credentials. Mitigation of this exposure necessitates immediate administrative intervention and software updates to secure environments against token reuse attacks.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling and validation state tracking of JSON Web Tokens (JWT) within Apache Ranger versions 2.8.0 and prior. The affected component fails to enforce strict stateful validation mechanisms, such as JTI (JWT ID) tracking, nonces, or rigorous token blacklisting, which are necessary to prevent the reuse of captured cryptographic assertions.\nDuring a typical attack flow, an attacker leverages a man-in-the-middle (MitM) position, network tap, or compromised logging facility to intercept a valid JWT generated during legitimate user authentication. Because the vulnerable implementation of Apache Ranger does not invalidate or restrict the token after its initial processing within the designated validity window, the intercepted JWT retains its cryptographic validity and authorization privileges.\nThe attacker then transmits the harvested JWT payload in subsequent HTTP authorization headers to the vulnerable Apache Ranger service. The server evaluates the cryptographic signature of the token and, finding the signature intact and the expiration time unreached, accepts the token as legitimate. This grants the attacker unauthorized access to protected API endpoints and administrative functionalities corresponding to the privileges encoded within the token payload.\nThe vulnerability affects Apache Ranger versions <= 2.8.0. Exploitation requires network exposure of the authentication or API endpoints accepting JWT assertions. Depending on the system configuration, authentication may be bypassed entirely for subsequent requests if the initial token is successfully intercepted and replayed. Post-exploitation impact encompasses unauthorized data exfiltration, privilege escalation within the authorization matrix, and unauthorized modification of security policies managed by Apache Ranger."
}