LDAP filter injection in Apache Zeppelin LdapRealm (CVE-2026-44617)

Apache Zeppelin's LdapRealm applied RFC 4514 distinguished-name escaping instead of RFC 4515 filter escaping when constructing LDAP search filters, leaving special filter characters insufficiently escaped. This constitutes an incomplete fix of CVE-2024-31867 and allows LDAP filter injection attacks against affected deployments. Affected versions: - Apache Zeppelin 0.11.1 - Apache Zeppelin 0.11.2 - Apache Zeppelin 0.12.0 We recommend updating to: 0.12.1. CVSS 6.5 · our assessment: this_month Reference: https://seclists.org/oss-sec/2026/q3/329 Details: https://vuln.today/cve/CVE-2026-44617