CVE-2026-44616

Awaiting Analysis Awaiting Analysis - Queue

LDAP Injection in Apache Zeppelin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Apache Software Foundation

Description

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory information. The role-lookup path was also affected after successful LDAP authentication. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-44616

EUVD

EUVD-2026-51161

Affected Vendors & Products

Vendor	Product	Version / Range
apache	zeppelin	From 0.6.0 (inc) to 0.12.0 (inc)
apache	zeppelin	0.12.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an LDAP injection vulnerability in Apache Zeppelin. It occurs because user-controlled input is not properly escaped when constructing LDAP search filters in the ActiveDirectoryGroupRealm component. An authenticated attacker can inject LDAP filter syntax through the user-search endpoint to manipulate queries and potentially access unauthorized directory information. The role-lookup path is also vulnerable after successful LDAP authentication.

Detection Guidance

Detecting LDAP injection in Apache Zeppelin requires checking for unescaped user input in LDAP search filters. Monitor logs for unusual LDAP queries containing special characters like asterisks or parentheses. Inspect network traffic to the user-search endpoint for malformed filter syntax. Verify if Zeppelin versions 0.6.0 to 0.12.0 are running.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive directory information, such as user credentials or group memberships. This could lead to further attacks like privilege escalation or data breaches. Systems using Apache Zeppelin versions 0.6.0 through 0.12.0 are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (protected health information). Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur due to unpatched systems.

Mitigation Strategies

Upgrade Apache Zeppelin to version 0.12.1 or later immediately. If upgrading is not possible, restrict access to the user-search endpoint and disable ActiveDirectoryGroupRealm until patched. Monitor LDAP logs for suspicious queries and implement input validation for user-controlled fields.

Hi! I’m here to help you understand CVE-2026-44616. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70