Vulnerability · Published Jul 30, 2026 · Assigned by apache

CVE-2026-44617Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

Medium 6.5

In plain English

A medium-severity security flaw in Apache Zeppelin from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 42.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Zeppelin	0.11.1 – before 0.12.1

Weakness: CWE-90 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Apache Zeppelin PR #5226 patch
CVE-2024-31867 (incomplete fix)
https://lists.apache.org/thread/s65t6n3s1v4j5b1w7zvv5w73ko69m1zv vendor-advisory