mkdocs/docs/release-notes/2.8.0.md

---
title: "Apache Ranger 2.8.0"
---
<!---
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->

# Apache Ranger 2.8.0 release notes

Apache Ranger 2.8.0 was released on March 1, 2026. The release introduces the `authz-api` and `authz-embedded` modules, service-managed ACLs in the policy engine, Kerberized Solr audit support in the installers, and many dependency upgrades and bug fixes.

## Highlights

- **Authorization API modules** — new `authz-api` ([RANGER-5309](https://issues.apache.org/jira/browse/RANGER-5309)) and `authz-embedded` ([RANGER-5312](https://issues.apache.org/jira/browse/RANGER-5312)) modules define a component-neutral
  authorization request/response model and an embedded authorizer.
- **Policy engine support for service-managed ACLs** ([RANGER-5369](https://issues.apache.org/jira/browse/RANGER-5369)) and synchronous policy-cache download for testing plugins ([RANGER-5230](https://issues.apache.org/jira/browse/RANGER-5230)).
- **Kerberized Solr audit** — Admin and plugin installers accept configuration for a Kerberos-protected Solr audit destination
  ([RANGER-5382](https://issues.apache.org/jira/browse/RANGER-5382), [RANGER-5383](https://issues.apache.org/jira/browse/RANGER-5383)); the audit UI can query Kerberized Solr ([RANGER-5384](https://issues.apache.org/jira/browse/RANGER-5384)).
- **Authentication** — `RangerRESTClient` can fetch a JWT when one is available ([RANGER-5475](https://issues.apache.org/jira/browse/RANGER-5475)); clients can reach secure API endpoints in
  non-Kerberos environments ([RANGER-5488](https://issues.apache.org/jira/browse/RANGER-5488)).
- **Audit filters** can exclude by resource name ([RANGER-5315](https://issues.apache.org/jira/browse/RANGER-5315), [RANGER-5325](https://issues.apache.org/jira/browse/RANGER-5325)).
- **Operations** — change the log level without a restart ([RANGER-5266](https://issues.apache.org/jira/browse/RANGER-5266)), last login date and time on the home page ([RANGER-5271](https://issues.apache.org/jira/browse/RANGER-5271)), Ozone authorizer
  support for AssumeRole ([RANGER-5393](https://issues.apache.org/jira/browse/RANGER-5393)).
- **Dependencies** — Hadoop 3.4.2 ([RANGER-5467](https://issues.apache.org/jira/browse/RANGER-5467)), Kafka 3.9.1 ([RANGER-5457](https://issues.apache.org/jira/browse/RANGER-5457)), Tomcat 9.0.113 ([RANGER-5426](https://issues.apache.org/jira/browse/RANGER-5426)), Jetty 9.4.57 ([RANGER-5460](https://issues.apache.org/jira/browse/RANGER-5460)), Elasticsearch 7.17.29 ([RANGER-4939](https://issues.apache.org/jira/browse/RANGER-4939)),
  `hadoop-common` replaced by smaller dependencies ([RANGER-5478](https://issues.apache.org/jira/browse/RANGER-5478)), migration from commons-lang 2.6 to commons-lang3 ([RANGER-5391](https://issues.apache.org/jira/browse/RANGER-5391)).
- **Security fixes** — XML External Entity injection ([RANGER-5477](https://issues.apache.org/jira/browse/RANGER-5477)), server version disclosure in Ranger KMS ([RANGER-5416](https://issues.apache.org/jira/browse/RANGER-5416)), users with names
  similar to `admin`/`keyadmin` could query those accounts ([RANGER-5342](https://issues.apache.org/jira/browse/RANGER-5342)).
- **Docker** — Kerberos support in the docker setup ([RANGER-4898](https://issues.apache.org/jira/browse/RANGER-4898)), volume mounts for service and plugin configuration ([RANGER-5396](https://issues.apache.org/jira/browse/RANGER-5396), [RANGER-5401](https://issues.apache.org/jira/browse/RANGER-5401)),
  Ranger authorization for Solr ([RANGER-5451](https://issues.apache.org/jira/browse/RANGER-5451)).

## Component versions

The release was built and tested with the following component versions (as recorded in the release notes):

| Component | Version |
| --- | --- |
| Java | JDK 8 |
| Python | 3.10.12 |
| MariaDB | 10.7.3 |
| PostgreSQL | 13.16 |
| Oracle | 23.6 |
| Apache Solr | 8.11.3 |

## Artifacts

| Artifact | Location |
| --- | --- |
| Source tarball | [apache-ranger-2.8.0.tar.gz](https://downloads.apache.org/ranger/2.8.0/apache-ranger-2.8.0.tar.gz) ([signature](https://downloads.apache.org/ranger/2.8.0/apache-ranger-2.8.0.tar.gz.asc), [SHA-512](https://downloads.apache.org/ranger/2.8.0/apache-ranger-2.8.0.tar.gz.sha512)) |
| Binary tarballs | [https://downloads.apache.org/ranger/2.8.0/services/](https://downloads.apache.org/ranger/2.8.0/services/) (admin, usersync, tagsync, kms), [https://downloads.apache.org/ranger/2.8.0/plugins/](https://downloads.apache.org/ranger/2.8.0/plugins/), [https://downloads.apache.org/ranger/2.8.0/tools/](https://downloads.apache.org/ranger/2.8.0/tools/) |
| Release directory | [https://downloads.apache.org/ranger/2.8.0/](https://downloads.apache.org/ranger/2.8.0/) |
| Git tag | [release-ranger-2.8.0](https://github.com/apache/ranger/tree/release-ranger-2.8.0) |
| Docker images | `apache/ranger:2.8.0`, `apache/ranger-db:2.8.0`, `apache/ranger-solr:2.8.0`, `apache/ranger-zk:2.8.0` on [Docker Hub](https://hub.docker.com/r/apache/ranger/tags) |
| Maven Central | `org.apache.ranger:*:2.8.0` |
| Archive | [archive.apache.org/dist/ranger/2.8.0/](https://archive.apache.org/dist/ranger/2.8.0/) |

Verify every download against its `.asc` signature and checksum file before you use it; see [Download and verify](download.md).

## Resolved issues

The tables below list the 91 JIRA issues recorded in the release notes for this version (47 improvements, 36 bugs fixed, 8 tasks). Each key links to the issue in the Apache JIRA.

### Improvements

| JIRA | Summary |
| --- | --- |
| [RANGER-5389](https://issues.apache.org/jira/browse/RANGER-5389) | Replace unmaintained jquery-cookie library with modern alternative |
| [RANGER-5488](https://issues.apache.org/jira/browse/RANGER-5488) | Allow clients to access secure API endpoints in Ranger Admin in non-kerberos envs |
| [RANGER-5478](https://issues.apache.org/jira/browse/RANGER-5478) | replace hadoop-common dependency with smaller |
| [RANGER-5475](https://issues.apache.org/jira/browse/RANGER-5475) | Add support to fetch JWT if available in RangerRESTClient |
| [RANGER-5467](https://issues.apache.org/jira/browse/RANGER-5467) | update Hadoop version to 3.4.2 |
| [RANGER-5462](https://issues.apache.org/jira/browse/RANGER-5462) | update commons-beanutils version |
| [RANGER-5460](https://issues.apache.org/jira/browse/RANGER-5460) | update jetty version to 9.4.57.v20241219 |
| [RANGER-5459](https://issues.apache.org/jira/browse/RANGER-5459) | remove reference to unused library mysql-connector-java |
| [RANGER-5457](https://issues.apache.org/jira/browse/RANGER-5457) | Update Kafka version to 3.9.1 |
| [RANGER-5451](https://issues.apache.org/jira/browse/RANGER-5451) | Docker setup update to configure Ranger authorization in Solr |
| [RANGER-5447](https://issues.apache.org/jira/browse/RANGER-5447) | local policy source implementations to support loading from <serviceName>.json |
| [RANGER-5443](https://issues.apache.org/jira/browse/RANGER-5443) | fix Unchecked cast warnings in JsonUtils |
| [RANGER-5442](https://issues.apache.org/jira/browse/RANGER-5442) | replace repeated Gson instantiation with JsonUtils method calls |
| [RANGER-5438](https://issues.apache.org/jira/browse/RANGER-5438) | Upgrade qs, express and node-forge library in Ranger React UI. |
| [RANGER-5434](https://issues.apache.org/jira/browse/RANGER-5434) | Add test users keytabs to the ranger and dependency service docker containers |
| [RANGER-5433](https://issues.apache.org/jira/browse/RANGER-5433) | update service-def json files to improve readability |
| [RANGER-5426](https://issues.apache.org/jira/browse/RANGER-5426) | Update tomcat to 9.0.113 |
| [RANGER-5401](https://issues.apache.org/jira/browse/RANGER-5401) | \[docker\] Use Volume Mounts for ranger-plugin configs |
| [RANGER-5396](https://issues.apache.org/jira/browse/RANGER-5396) | \[docker\] Use Volume Mounts for ranger-service configs |
| [RANGER-5393](https://issues.apache.org/jira/browse/RANGER-5393) | Ranger Ozone authorizer updates to support AssumeRole |
| [RANGER-5386](https://issues.apache.org/jira/browse/RANGER-5386) | Docker setup update to use latest Trino release |
| [RANGER-5383](https://issues.apache.org/jira/browse/RANGER-5383) | plugin installation to support configurations for Kerberized Solr audit destination |
| [RANGER-5382](https://issues.apache.org/jira/browse/RANGER-5382) | Admin server installation to support configurations for Kerberized Solr |
| [RANGER-5381](https://issues.apache.org/jira/browse/RANGER-5381) | add krb5-user package in ranger-base image |
| [RANGER-5369](https://issues.apache.org/jira/browse/RANGER-5369) | policy engine support for service-managed ACLs |
| [RANGER-5338](https://issues.apache.org/jira/browse/RANGER-5338) | Make XMLUtils's error message more informative |
| [RANGER-5336](https://issues.apache.org/jira/browse/RANGER-5336) | Upgrade bouncycastle to 1.79 due to CVE-2025-8916 and CVE-2025-8885 |
| [RANGER-5332](https://issues.apache.org/jira/browse/RANGER-5332) | Ranger: Upgrade axios version 1.8.4 to latest 1.12.2 |
| [RANGER-5325](https://issues.apache.org/jira/browse/RANGER-5325) | Ranger Access audit option to exclude resource |
| [RANGER-5320](https://issues.apache.org/jira/browse/RANGER-5320) | Handle unsupported cipher key creation |
| [RANGER-5315](https://issues.apache.org/jira/browse/RANGER-5315) | Enhance Audit Log Filters to Support Resource Name Exclusions |
| [RANGER-5294](https://issues.apache.org/jira/browse/RANGER-5294) | FileUtils.isOwnerOfFileHierarchy doesn’t have the recurse parameter |
| [RANGER-5293](https://issues.apache.org/jira/browse/RANGER-5293) | Upgrade netty to 4.1.124.Final |
| [RANGER-5291](https://issues.apache.org/jira/browse/RANGER-5291) | 'User' role users api '/service/roles/roles' is giving 400 status |
| [RANGER-5283](https://issues.apache.org/jira/browse/RANGER-5283) | Updating library dependencies in Ranger Admin React package-lock.json |
| [RANGER-5271](https://issues.apache.org/jira/browse/RANGER-5271) | Last login date and time on Ranger Home page |
| [RANGER-5269](https://issues.apache.org/jira/browse/RANGER-5269) | Update UI hint for Ranger service definition for HA enabled HDFS |
| [RANGER-5266](https://issues.apache.org/jira/browse/RANGER-5266) | Change log level without service restart |
| [RANGER-5230](https://issues.apache.org/jira/browse/RANGER-5230) | Support synchronous policy cache download for testing plugins |
| [RANGER-5215](https://issues.apache.org/jira/browse/RANGER-5215) | Policy authroization fails for Ranger Plugins in case of users/groups converted by Ranger userysnc as per given Regex |
| [RANGER-5212](https://issues.apache.org/jira/browse/RANGER-5212) | Search filter in Roles tab does not consider all relevant role columns |
| [RANGER-5200](https://issues.apache.org/jira/browse/RANGER-5200) | Add search Parameter for "XA Group of Users" in Audit Admin logs Tab. |
| [RANGER-5148](https://issues.apache.org/jira/browse/RANGER-5148) | Redundant Role Cache Modification Triggers Caused by Role Version Changes in Scenarios with a Large Number of Plugin Clients |
| [RANGER-4939](https://issues.apache.org/jira/browse/RANGER-4939) | Upgrade Elasticsearch version to 7.17.29 |
| [RANGER-4247](https://issues.apache.org/jira/browse/RANGER-4247) | auditPolicyEvaluators should be set before logging it |
| [RANGER-3313](https://issues.apache.org/jira/browse/RANGER-3313) | Remove org.apache.ranger.audit.entity.AuthzAuditEventDbObj from JPA (persistence.xml) |
| [RANGER-2713](https://issues.apache.org/jira/browse/RANGER-2713) | Remove audit fields from XXPolicyRef objects |

### Bugs fixed

| JIRA | Summary |
| --- | --- |
| [RANGER-5494](https://issues.apache.org/jira/browse/RANGER-5494) | Docker setup: ranger-hive container missing log4j configuration files |
| [RANGER-5495](https://issues.apache.org/jira/browse/RANGER-5495) | replace references to org.apache.log4j with org.slf4j |
| [RANGER-3643](https://issues.apache.org/jira/browse/RANGER-3643) | Service config UI to include additional configurations like service.admin.users, service.admin.groups |
| [RANGER-5416](https://issues.apache.org/jira/browse/RANGER-5416) | Disable Server Version Disclosure in HTTP Response for Ranger KMS |
| [RANGER-5477](https://issues.apache.org/jira/browse/RANGER-5477) | XML External Entity Injection Security issue in Ranger |
| [RANGER-5476](https://issues.apache.org/jira/browse/RANGER-5476) | PolicyRefresher.stopRefresher() can deadlock when retrying HTTP request |
| [RANGER-5461](https://issues.apache.org/jira/browse/RANGER-5461) | Incorrect condition in computeDeletedGroups() prevents groups from being marked as HIDDEN |
| [RANGER-5458](https://issues.apache.org/jira/browse/RANGER-5458) | Tagsync fails while initializing Atlas source |
| [RANGER-5441](https://issues.apache.org/jira/browse/RANGER-5441) | Docker: HiveServer2 initialization fails in creating Zookeeper node /hiveserver2 |
| [RANGER-5431](https://issues.apache.org/jira/browse/RANGER-5431) | Docker: ranger-admin-site.xml contains invalid property values |
| [RANGER-5422](https://issues.apache.org/jira/browse/RANGER-5422) | Fix incorrect date format in logback.xml |
| [RANGER-5407](https://issues.apache.org/jira/browse/RANGER-5407) | In Atlas Service for some of the default policies wrong permissions seen |
| [RANGER-5405](https://issues.apache.org/jira/browse/RANGER-5405) | PatchForSolrSvcDefAndPoliciesUpdate_J10055 Java patch fails during upgrade |
| [RANGER-5404](https://issues.apache.org/jira/browse/RANGER-5404) | Modify the evtTime format to avoid format errors in ES |
| [RANGER-5403](https://issues.apache.org/jira/browse/RANGER-5403) | Intermittent HDFS authorization failures caused by unsafe lazy initialization in CaseSensitiveRecursiveMatcher |
| [RANGER-5402](https://issues.apache.org/jira/browse/RANGER-5402) | Fix the out-of-bounds issue caused by overly long kms keys |
| [RANGER-5399](https://issues.apache.org/jira/browse/RANGER-5399) | Ranger: HTTP 403 - User '' lacks delegated-admin privilege when attempting to GRANT privilege on a database |
| [RANGER-5397](https://issues.apache.org/jira/browse/RANGER-5397) | IllegalArgumentException in RangerRESTClient when no ranger.plugin.<service>.policy.rest.url is configured |
| [RANGER-5394](https://issues.apache.org/jira/browse/RANGER-5394) | policyEngine should be volatile to prevent policy update visibility race |
| [RANGER-5392](https://issues.apache.org/jira/browse/RANGER-5392) | Policies created by grant command have empty 'created by' and 'updated by' fields |
| [RANGER-5391](https://issues.apache.org/jira/browse/RANGER-5391) | Migrate from commons-lang 2.6 to commons-lang3 3.19.0 to fix CVE-2025-48924 |
| [RANGER-5384](https://issues.apache.org/jira/browse/RANGER-5384) | Audit UI fails to query from kerberized Solr |
| [RANGER-5361](https://issues.apache.org/jira/browse/RANGER-5361) | Updating node & npm version getting used for building ranger admin js code in security-admin module |
| [RANGER-5352](https://issues.apache.org/jira/browse/RANGER-5352) | Resource changes in tag does not work correctly when delta sync & dedup is enabled |
| [RANGER-5342](https://issues.apache.org/jira/browse/RANGER-5342) | USER-role users with names similar to admin or keyadmin can query those admin/keyadmin users. |
| [RANGER-5340](https://issues.apache.org/jira/browse/RANGER-5340) | RangerResourceACLs has incorrect isFinal flag for ACLs from GDS policy engine |
| [RANGER-5322](https://issues.apache.org/jira/browse/RANGER-5322) | PolicyRefresher can struck with no download thread if exception thrown in startRefresher |
| [RANGER-5270](https://issues.apache.org/jira/browse/RANGER-5270) | Audits > Admin tab: Zone name missing in "Delete Zone Policy" log |
| [RANGER-5259](https://issues.apache.org/jira/browse/RANGER-5259) | Ranger Does Not Clean Up Stale Plugin Entries After Role Deletion or Migration |
| [RANGER-4883](https://issues.apache.org/jira/browse/RANGER-4883) | audit to HDFS fails with error: org.apache.hadoop.fs.UnsupportedFileSystemException: No FileSystem for scheme "hdfs" |
| [RANGER-4518](https://issues.apache.org/jira/browse/RANGER-4518) | Improvement in state management for search filter parameters in Ranger React |
| [RANGER-4021](https://issues.apache.org/jira/browse/RANGER-4021) | Shell syntax bug in kms setup.sh |
| [RANGER-3965](https://issues.apache.org/jira/browse/RANGER-3965) | When creating a key with too long attribute values, KMS returns OK but key not really added |
| [RANGER-3491](https://issues.apache.org/jira/browse/RANGER-3491) | Not find TAG serviceDef when update tag serviceDef for loading service-defs json file |
| [RANGER-3222](https://issues.apache.org/jira/browse/RANGER-3222) | Ranger yarn plugin does not support parsing fair scheduler json or xml response |
| [RANGER-3166](https://issues.apache.org/jira/browse/RANGER-3166) | Spaced are authorized in LDAP value strings but the setup.sh script doesnt account for spaces |

### Tasks

| JIRA | Summary |
| --- | --- |
| [RANGER-5302](https://issues.apache.org/jira/browse/RANGER-5302) | Code Coverage changes for React JS script files |
| [RANGER-5464](https://issues.apache.org/jira/browse/RANGER-5464) | Update lodash version from 4.17.21 to 4.17.23 |
| [RANGER-4898](https://issues.apache.org/jira/browse/RANGER-4898) | Docker setup to support kerberos authentication |
| [RANGER-4771](https://issues.apache.org/jira/browse/RANGER-4771) | Remove the calls to ensureAdminAccess() in grantAccess() and revokeAccess() |
| [RANGER-5367](https://issues.apache.org/jira/browse/RANGER-5367) | simplify resourceName parsing |
| [RANGER-5324](https://issues.apache.org/jira/browse/RANGER-5324) | replace use of iterations with streams: RangerRequestScriptEvaluator |
| [RANGER-5312](https://issues.apache.org/jira/browse/RANGER-5312) | Add module: authz-embedded |
| [RANGER-5309](https://issues.apache.org/jira/browse/RANGER-5309) | Add module: authz-api |

## Further reading

- [Apache Ranger 2.8.0 - Release Notes (cwiki)](https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+2.8.0+-+Release+Notes)
- [All issues with fixVersion 2.8.0 in JIRA](https://issues.apache.org/jira/issues/?jql=project%20%3D%20RANGER%20AND%20fixVersion%20%3D%202.8.0)
- [Release index](index.md) and [Download and verify](download.md)