CVE-2024-31860

CVE-2024-31860 affects Apache Zeppelin through an improper input validation flaw that enables path traversal via relative paths (e.g., ..). The issue allows an attacker to view files on the server filesystem that the Zeppelin server account can access. Affected range: Zeppelin 0.9.0 up to before ...

CVE-2024-31865

CVE-2024-31865 affects Apache Zeppelin due to an Improper Input Validation in the cron API, allowing arbitrary user impersonation with insufficient privileges. Affected versions are 0.8.2 up to before 0.11.1; upgrading to 0.11.1 or later fixes the issue. The CVE entry and linked sources (Red Hat,...

CVE-2018-1328

CVE-2018-1328 affects Apache Zeppelin prior to 0.8.0, where a stored XSS flaw exists via Note permissions. The root cause is unsanitized input in Note handling that can trigger script execution. Impact is user-facing XSS; remediation is upgrading Zeppelin to 0.8.0 or later (or applying equivalent...

CVE-2021-27578

CVE-2021-27578 is a Cross Site Scripting vulnerability in the Markdown interpreter of Apache Zeppelin. Affected product: Apache Zeppelin (web-based notebook). Affected version: prior to 0.9.0. Root cause: XSS in the markdown interpreter that allows an attacker to inject malicious scripts. Impact:...

CVE-2024-31867

CVE-2024-31867 – Apache Zeppelin LDAP search filter injection indicates an improper input validation vulnerability in Zeppelin. The issue allows an attacker to execute malicious queries by manipulating LDAP search filter configuration properties, affecting Zeppelin versions from 0.8.2 up to, but ...

CVE-2024-31868

CVE-2024-31868 affects Apache Zeppelin: improper encoding/escaping in the helium module enables cross-site scripting by modifying helium.json. Impact described as user-facing XSS; affects 0.8.2–0.11.0, fixed in 0.11.1. Remediation: upgrade to Zeppelin 0.11.1 or later. Other sources (Red Hat, Vera...

CVE-2021-28655

CVE-2021-28655 (Apache Zeppelin) describes an improper input validation in the Move folder to Trash feature, enabling an attacker to delete arbitrary files. Affected product: Apache Zeppelin, version 0.9.0 and prior. Root cause: input validation flaw in the Move folder to Trash flow (NotebookServ...

CVE-2026-44613

Apache Zeppelin exposes CSRF in REST and WebSocket request handling due to default CORS configuration that allows cross-origin state-changing requests and text/plain bodies. Affected versions are 0.6.0 through 0.12.0; upgrade to 0.12.1 to fix the issue. The CVE describes an attacker luring an aut...

CVE-2024-41177

CVE-2024-41177 affects Apache Zeppelin (Helium module) up to version 0.12.0. The issue is an Incomplete Blacklist to Cross-Site Scripting vulnerability in the Helium module, allowing XSS via insufficient input validation. The recommended remediation is to upgrade org.apache.zeppelin:zeppelin-web ...

CVE-2026-44615

CVE-2026-44615 describes a path traversal vulnerability in Apache Zeppelin versions 0.9.0 through 0.12.0 when FileSystemNotebookRepo is configured. An authenticated attacker with permission to rename a note or access folder operations can supply traversal segments in note or folder paths. Zeppeli...

CVE-2026-44617

Apache Zeppelin (LdapRealm) has a LDAP filter injection issue due to escaping using RFC 4514 (DN escaping) instead of RFC 4515 filter escaping. This incomplete fix affects Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 and is a partial remediation of CVE-2024-31867. Upgrading to version 0.12.1 is r...

CVE-2026-44616

CVE-2026-44616 describes an LDAP injection vulnerability in Apache Zeppelin where the ActiveDirectoryGroupRealm constructed LDAP search filters using unescaped user input. This allows an authenticated attacker to inject LDAP filter syntax via the user-search endpoint and potentially expose direct...