org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44615 via org.apache.zeppelin:zeppelin-zengine (>=0.9.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.12.0 Source cves: CVE-2026-44615 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-18507761...

org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44615 via org.apache.zeppelin:zeppelin-zengine (>=0.6.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.6.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.12.0 Source cves: CVE-2026-44615 Source advisory: MEND:CVE-2026-44615...

org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44613 via org.apache.zeppelin:zeppelin-zengine (>=0.6.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.6.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.12.0 Source cves: CVE-2026-44613 Source advisory: MEND:CVE-2026-44613...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the raft server protocol. An attacker can access sensitive server resources, including directories and files, by sending unauthenticated requests. Remediatio...

org.apache.zeppelin:launcher-cluster (>=0.10.1, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.10.1, <=0.11.2) +13 more potentially affected by CVE-2024-41169 via org.apache.zeppelin:zeppelin-zengine (>=0.10.1, <=0.11.2)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.11.2 Source cves: CVE-2024-41169 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-10743195...

OS Command Injection

zeppelin-zengine is vulnerable to OS command injection. An attacker is able to inject bash commands into Spark interpreter settings...

Authentication Bypass

zeppelin-zengine is vulnerable to authentication bypass. The vulnerability exists as users could execute paragraphs as other users without authentication due to the value of cronExecutionUser...

Information Leakage

Apache Zeppelin Zengine is vulnerable to sensitive information leakage. Sensitive information is logged or printed out from Authentication.java when the system data leaves the program through an output stream or logger...