LDAP Injection Vulnerability in Apache Zeppelin by Apache
CVE-2026-44616

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Zeppelin
Vendor
CVE Published:
30 July 2026

What is CVE-2026-44616?

An LDAP injection vulnerability exists in Apache Zeppelin that allows authenticated attackers to manipulate LDAP search filters due to the lack of user input escaping. By exploiting this flaw through the user-search endpoint, an attacker can potentially reveal sensitive directory information. Furthermore, the role-lookup path is also influenced after successful LDAP authentication, exacerbating the risk. Users are advised to upgrade to Apache Zeppelin version 0.12.1 or later to mitigate these risks.

Affected Version(s)

Apache Zeppelin 0.6.0 < 0.12.1

References

https://github.com/apache/zeppelin/pull/5226
patch
https://lists.apache.org/thread/p6llqpvcszpg1wc8kx5ncfkdb...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Cosentino from Apache Software Foundation
.