CVE-2026-44617

Medium

Description

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

SeverityMedium

CVSS6.5

Exploit probability—

Product

Apache Zeppelin

PublishedJul 30, 2026

First seenJul 30, 2026

Weakness typeCWE-90CWE-90

How to fix

Update

apache zeppelin0.12.1 or later

Patches

github.com/apache/zeppelin/pull/5226

Vendor advisories

lists.apache.org/thread/s65t6n3s1v4j5b1w7zvv5w73ko69m1zv

Affected products

Product	Affected versions	Fixed in
apache zeppelin	0.11.1 ≤ v < 0.12.1	0.12.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.