Exploit for Cross-Site Request Forgery (CSRF) in Apache Zeppelin

CVE-2026-44613 Donate Support the maintenance of this pro...

org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44615 via org.apache.zeppelin:zeppelin-zengine (>=0.9.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.12.0 Source cves: CVE-2026-44615 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-18507761...

CVE-2026-44615 Path traversal in NotebookRepo note and folder path composition

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44615 via org.apache.zeppelin:zeppelin-zengine (>=0.6.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.6.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.12.0 Source cves: CVE-2026-44615 Source advisory: MEND:CVE-2026-44615...

CVE-2026-44615: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

CVE-2026-44617

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44616

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory...

CVE-2026-44617 Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

CVE-2026-44617 Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

EUVD-2026-51162

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

EUVD-2026-51160

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613

Apache Zeppelin (versions 0.6.0 through 0.12.0 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause lies in a default CORS configuration that permits cross-origin state-changing requests and accepts text/plain request bodies. Specifically, the CorsFilter, CorsUtils, and RES...

org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44613 via org.apache.zeppelin:zeppelin-zengine (>=0.6.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.6.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.12.0 Source cves: CVE-2026-44613 Source advisory: MEND:CVE-2026-44613...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44616: Improper Neutralization of Special Elements used in an LDAP Query

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory...

CVE-2026-44617: Improper Neutralization of Special Elements used in an LDAP Query

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...