CVE-2026-44613

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Request Forgery in Apache Zeppelin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Apache Software Foundation

Description

Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-44613

EUVD

EUVD-2026-51160

Affected Vendors & Products

Vendor	Product	Version / Range
apache	zeppelin	From 0.6.0 (inc) to 0.12.0 (inc)
apache	zeppelin	0.12.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin requests that could change state and accepted text/plain request bodies. An attacker could trick an authenticated user into visiting a malicious site and perform actions on their behalf through REST and WebSocket endpoints.

Detection Guidance

To detect this CSRF vulnerability in Apache Zeppelin, check if your version is between 0.6.0 and 0.12.0. Verify the CORS configuration allows cross-origin state-changing requests and text/plain request bodies. Inspect network traffic for unauthorized REST or WebSocket requests originating from user interactions with external sites.

Impact Analysis

An attacker could perform unauthorized actions on your behalf if you are logged into Apache Zeppelin and visit a malicious site. This could include modifying data, executing commands, or accessing sensitive information through REST and WebSocket endpoints.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations using affected Apache Zeppelin versions may face compliance risks due to insufficient access controls.

Mitigation Strategies

Upgrade Apache Zeppelin to version 0.12.1 or later to fix the CSRF vulnerability. Disable CORS if not needed and restrict cross-origin requests to trusted domains only.

Hi! I’m here to help you understand CVE-2026-44613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70