CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44617

Summary: CVE-2026-44617 describes an LDAP filter injection in Apache Zeppelin’s LdapRealm caused by escaping using RFC 4514 (DN escaping) instead of RFC 4515 (filter escaping), leading to insufficiently escaped special filter characters. This is an incomplete fix of CVE-2024-31867. Affected versi...

CVE-2026-44616

The CVE-2026-44616 entry concerns Apache Zeppelin and an LDAP injection flaw in the ActiveDirectoryGroupRealm filter construction. Authenticated users can abuse unescaped input to affect LDAP search filters via the user-search endpoint, with the role-lookup path also impacted after LDAP authentic...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...