CVE-2026-44617

Awaiting Analysis Awaiting Analysis - Queue

LDAP Filter Injection in Apache Zeppelin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Apache Software Foundation

Description

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-44617

EUVD

EUVD-2026-51162

Affected Vendors & Products

Vendor	Product	Version / Range
apache	zeppelin	0.11.1
apache	zeppelin	0.11.2
apache	zeppelin	0.12.0
apache	zeppelin	0.12.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an LDAP filter injection vulnerability in Apache Zeppelin. The LdapRealm component incorrectly used RFC 4514 distinguished-name escaping instead of RFC 4515 filter escaping when building LDAP search filters. This left special filter characters improperly escaped, allowing potential injection attacks. It is noted as an incomplete fix for a previous vulnerability (CVE-2024-31867).

Detection Guidance

This vulnerability involves LDAP filter injection due to improper escaping in Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. To detect it, check your Zeppelin version with commands like 'zeppelin --version' or inspect the web interface. Look for unusual LDAP queries or errors in logs that may indicate filter injection attempts.

Impact Analysis

An attacker could exploit this to inject malicious LDAP queries, potentially bypassing authentication, accessing unauthorized data, or performing unauthorized actions within the Zeppelin application. This could lead to data breaches or system compromise depending on the application's use of LDAP for authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected Zeppelin versions may face compliance violations, potential fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade Apache Zeppelin to version 0.12.1 or later to address the LDAP filter injection vulnerability. This version includes the proper fix for the incomplete CVE-2024-31867 mitigation.

Hi! I’m here to help you understand CVE-2026-44617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70