Security Advisory

CVE-2026-44616

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-30 15:21:21

Last updated 2026-07-31 17:51:37

Assigner apache

CVSS score not scored

State PUBLISHED

Description

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory information. The role-lookup path was also affected after successful LDAP authentication. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

← Browse all CVEs View on cve.org ↗