Apache Ranger 2.9.0 was released on August 8, 2026. It is the current stable release. The release adds the Ranger PDP server, a thin-client authorization library, a Polaris plugin, action-based policy evaluation for Ozone, header-based authentication and a large number of security and dependency fixes.
pdp module that runs the policy engine as a standalone service and answers authorization requests over REST (RANGER-5371). A companion authz-remote library lets plugins integrate as thin clients (RANGER-5550), and RangerEmbeddedAuthorizer accepts a caller-provided audit handler (RANGER-5505).action-matches policy condition and matchers for S3-style actions, behind a feature flag (RANGER-5628, RANGER-5667, RANGER-5687).doAsUser parameter (RANGER-5539).ranger-common-utils module (RANGER-5519), removal of jersey-bundle and javax.servlet-api dependencies (RANGER-5523, RANGER-5515)._expression conditions (RANGER-5629), Hive CTAS/temporary-table UDF authorization (RANGER-5634).apache-ranger Python client 0.0.13 (RANGER-5653), Performance Analyser on Python 3.11 (RANGER-5532); the default access-audit store for a fresh install is Solr (RANGER-5710).The release was built and tested with the following component versions (as recorded in the release notes):
| Component | Version |
|---|---|
| Java | JDK 8 |
| Python | 3.10+ for Ranger server scripts and tools; the apache-ranger PyPI client 0.0.13 requires Python 3.13+; the Performance Analyser supports Python 3.11 |
| MariaDB | 10.7.3 |
| PostgreSQL | 13.16 |
| Oracle | 23.6 |
| Apache Hadoop | 3.4.2 |
| Apache Kafka | 3.9.1 |
| Apache Ozone | 2.1.1 |
| Apache Solr | 8.11.3 |
| Apache Tomcat (embedded) | 9.0.115 |
| Artifact | Location |
|---|---|
| Source tarball | apache-ranger-2.9.0.tar.gz (signature, SHA-512) |
| Binary tarballs | https://downloads.apache.org/ranger/2.9.0/services/ (admin, usersync, tagsync, kms, pdp), https://downloads.apache.org/ranger/2.9.0/plugins/, https://downloads.apache.org/ranger/2.9.0/tools/ |
| Release directory | https://downloads.apache.org/ranger/2.9.0/ |
| Git tag | release-ranger-2.9.0 |
| Docker images | apache/ranger:2.9.0, apache/ranger-db:2.9.0, apache/ranger-solr:2.9.0 on Docker Hub |
| Maven Central | org.apache.ranger:*:2.9.0 |
| Archive | archive.apache.org/dist/ranger/2.9.0/ |
Verify every download against its .asc signature and checksum file before you use it; see Download and verify.
The tables below list the 68 JIRA issues recorded in the release notes for this version (30 improvements, 22 bugs fixed, 16 tasks). Each key links to the issue in the Apache JIRA.
| JIRA | Summary |
|---|---|
| RANGER-3899 | Policy creation takes more time when there are more users,groups,roles |
| RANGER-4910 | Develop Apache Ranger Plugin for Polaris to Enhance Access Control for Apache Iceberg |
| RANGER-5371 | module: Ranger PDP server |
| RANGER-5493 | Update tomcat to 9.0.115 |
| RANGER-5499 | Support header based authentication |
| RANGER-5505 | update RangerEmbeddedAuthorizer to support caller provided audit handler |
| RANGER-5515 | remove javax.servlet-api depedency in agents-common module |
| RANGER-5516 | update commons-configuration2 library version from 2.8.0 to 2.13.0 |
| RANGER-5517 | remove unnecessary dependency on ranger-plugins-common |
| RANGER-5519 | introduce ranger-common-utils module |
| RANGER-5522 | update tagsync to process Atlas notifications for Trino entities |
| RANGER-5523 | replace jersey-bundle dependency with jersey-client and jersey-core |
| RANGER-5529 | update RangerAuthorizer methods to be REST friendly |
| RANGER-5532 | Ranger Performance Analyser: Python 3.11 Support and Enhancements |
| RANGER-5539 | Add Authorisation Check for doAsUser Parameter |
| RANGER-5546 | Polaris service-def update to rename resource root to realm-identifier |
| RANGER-5549 | replace use of com.kstruct.gethostname4j library |
| RANGER-5550 | introduce authz-remote library to support thin client integration for plugins |
| RANGER-5564 | update RangerAuthzConfig to support properties from plugin configuration files |
| RANGER-5600 | Bump org.apache.avro:avro from 1.11.4 to 1.11.5 |
| RANGER-5601 | Bump urllib3 to 2.7.0 and requests from 2.32.5 to 2.33.0 |
| RANGER-5604 | Bump org.glassfish.jersey.core:jersey-client from 2.22.1 to 2.47 in /plugin-schema-registry |
| RANGER-5614 | Role creation/updation takes more time when there are more users,groups,roles |
| RANGER-5617 | Set PDP header authn cfg values to null |
| RANGER-5627 | support configuration-based super users and super groups in Ranger Admin |
| RANGER-5628 | Support for actions in Ozone Service Definition: Ozone STS action-based policy evaluation (RangerActionMatcher, RangerActionListMatcher), action-matches policy condition, Admin UI support on permission rows, DB patch PatchForOzoneServiceDefPolicyConditionUpdate_J10065, and Ozone dependency bump to 2.1.1 |
| RANGER-5639 | Upgrade bouncycastle to 1.84 |
| RANGER-5653 | Release apache-ranger Python client 0.0.13 with Python 3.13+ support |
| RANGER-5667 | Follow-on for RANGER-5628: deny requests missing s3Action when policy has action-matches restrictions, treat whitespace-only action lists as unrestricted, avoid unnecessary allocation in RangerActionMatcher, and fix Ozone policy UI crash when adding Allow/Deny conditions |
| RANGER-5513 | Enhance Ranger lookup API input validation |
| JIRA | Summary |
|---|---|
| RANGER-5407 | In Atlas Service for some of the default policies wrong permissions seen |
| RANGER-5463 | UserStore version not updated when group-user mappings are modified via UserSync |
| RANGER-5501 | missing accessType in audit logs generated by RangerEmbeddedAuthorizer |
| RANGER-5502 | Upgrade Netty to 4.1.130.Final to address CVEs |
| RANGER-5508 | fix Runtime.exec parameters |
| RANGER-5526 | Security Zone creation fails with tag service due to NonUniqueResultException |
| RANGER-5530 | [KMS]: dev_kms TestConnection from keyAdmin UI is failing after Kerberos implementation |
| RANGER-5538 | username set incorrectly |
| RANGER-5552 | Remove mvn repo for Apache Ozone in pom.xml |
| RANGER-5567 | allow validateConfig API available only for users with Ranger admin role |
| RANGER-5579 | add validation to DefaultSchemaRegistryClient createUrlSelector method |
| RANGER-5623 | UI Inconsistency: Groups tab userlist fails to reflect updated user-group mapping after successful PUT /xusers/groupusers request |
| RANGER-5624 | Inconsistent masking of updatedBy field in /xusers/groups/groupName/{group_name} API compared to /xusers/groups/{id} |
| RANGER-5629 | Harden GraalJS engine configuration used for policy condition (_expression) evaluation |
| RANGER-5634 | CTAS & Temporary-Table queries from Hive bypass UDF Select authorization |
| RANGER-5635 | ranger.admin.allow.unauthenticated.download.access is honored only when Kerberos is enabled |
| RANGER-5647 | Tag policy test fixtures, path matcher fix, and ISO EXPIRES_ON tag test dates to ranger-2.9 |
| RANGER-5648 | Solr authorization fails with NPE |
| RANGER-5689 | Standardize TLS hostname verification across Ranger HTTP clients using a uniform verifier |
| RANGER-5690 | UnixAuth service lacks rate limiting on authentication attempts |
| RANGER-5693 | RangerJwtAuthHandler logs full JWT bearer token on validation failure |
| RANGER-5687 | Add feature flag for work in RANGER-5628 |
| JIRA | Summary |
|---|---|
| RANGER-5490 | Update webpack version from 5.94.0 to 5.105.1 |
| RANGER-5491 | Update axios version from 1.12.2 to 1.13.5 |
| RANGER-5518 | Upgrade underscore.js from 1.13.6 to 1.13.8 |
| RANGER-5569 | Updating library dependencies in Ranger Admin React package-lock.json |
| RANGER-5605 | Fix Ranger build failure when triggered through Docker |
| RANGER-5638 | Upgrade handlebars to 4.7.9 |
| RANGER-5657 | Limit getAllModuleNames() to sys-admin sessions in SessionMgr |
| RANGER-5658 | Tag Sync: remove atlas.kafka.zookeeper.connect and fix Atlas Kafka consumer for Kafka 3.9 |
| RANGER-5694 | Refactor policy condition rendering component to ensure layout stability |
| RANGER-5709 | KMS secure download APIs: align Tags and Userstore with Policy/Roles — use getServiceByNameForDP() instead of getServiceByName() |
| RANGER-5710 | Default access audit store to Solr |
| RANGER-5637 | Ranger CI: fix plugins-docker-build (Ozone smoke-test failures) |
| RANGER-5640 | Align Ranger Ozone Docker with Ozone 2.1 |
| RANGER-5712 | Fix Trino/Ozone plugin auth in ranger-docker (Kerberos keytabs,policy download auth, Solr audit JAAS for Ozone) |
| RANGER-5716 | Fix swapped client IP and resource in KMS Ranger audits |
| RANGER-5718 | PDP server logs NoClassDefFoundError for GsonBuilder — gson JAR missing from pdp tarball lib/ |