LDAP Injection Vulnerability in Apache Zeppelin by Apache
CVE-2026-44616

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Zeppelin
Vendor
CVE Published:
30 July 2026

What is CVE-2026-44616?

An LDAP injection vulnerability exists in Apache Zeppelin that allows authenticated attackers to manipulate LDAP search filters due to the lack of user input escaping. By exploiting this flaw through the user-search endpoint, an attacker can potentially reveal sensitive directory information. Furthermore, the role-lookup path is also influenced after successful LDAP authentication, exacerbating the risk. Users are advised to upgrade to Apache Zeppelin version 0.12.1 or later to mitigate these risks.

Affected Version(s)

Apache Zeppelin 0.6.0 < 0.12.1

References

https://github.com/apache/zeppelin/pull/5226
patch
https://lists.apache.org/thread/p6llqpvcszpg1wc8kx5ncfkdb...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Cosentino from Apache Software Foundation
.