What is the CVSS score of CVE-2026-44616?

CVE-2026-44616 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache Zeppelin are affected by CVE-2026-44616?

Apache Zeppelin versions 0.6.0-0.12.0 contain an LDAP injection vulnerability in directory-integrated deployments that could expose user and group information from Active Directory and enable…. A patch is available.

How to fix or mitigate CVE-2026-44616?

Within 24 hours, identify and inventory all Apache Zeppelin deployments in your environment, including their versions and whether they are integrated with Active Directory or LDAP services. Within 7 days, upgrade all affected instances running versions 0.6.0 through 0.12.0 to Apache Zeppelin 0.12.1 or later; for deployments where immediate upgrade is not feasible, implement firewall rules to restrict access to the user-search and role-lookup endpoints to authorized administrators only. Within 30 days, analyze LDAP and directory service access logs for the period during which vulnerable versions were running to identify any anomalous query patterns or unauthorized directory access that may indicate exploitation.

Apache Zeppelin CVE-2026-44616

EUVD-2026-51161 MEDIUM

LDAP Injection (CWE-90)

2026-07-30

GHSA-8cjf-mhhj-2c5p

Apache LDAP Code Injection Zeppelin

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Network-accessible endpoint requires an authenticated session (PR:L); LDAP injection exposes sensitive directory data (C:H) and can manipulate query logic to influence authorization (I:L); no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Jul 31, 2026 - 18:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 16:03 EUVD

Analysis Generated

Jul 30, 2026 - 12:18 vuln.today

CVE Published

Jul 30, 2026 - 11:10 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

LDAP injection in Apache Zeppelin's ActiveDirectoryGroupRealm allows authenticated attackers to manipulate LDAP filter construction through the user-search endpoint, potentially exposing Active Directory user and group information across all versions 0.6.0 through 0.12.0. The role-lookup path following successful LDAP authentication is also vulnerable, broadening the exposure surface within directory-integrated deployments and introducing a secondary risk of authorization bypass by influencing group-membership query results. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; Apache Zeppelin 0.12.1 resolves this issue.

Technical ContextAI

Apache Zeppelin is a web-based, multi-language data analytics notebook commonly deployed in enterprise big-data environments alongside Apache Spark, Hadoop, and JDBC data sources. Its ActiveDirectoryGroupRealm component provides LDAP-based authentication and group authorization by querying an Active Directory server. The flaw is a classic CWE-90 (Improper Neutralization of Special Elements Used in an LDAP Query) condition: the component constructs LDAP search filter strings by directly concatenating user-controlled input without escaping LDAP metacharacters such as parentheses, asterisks, backslashes, or null bytes. Two code paths are affected - the user-search endpoint, which is reachable by any authenticated user, and the role-lookup path exercised after successful LDAP authentication. No CPE strings were provided in the input data; the affected component is the Java-based ActiveDirectoryGroupRealm class within the Zeppelin server, present in all releases from 0.6.0 through 0.12.0. The fix, confirmed in GitHub PR #5226, introduces proper escaping of user-supplied values before filter construction.

RemediationAI

Upgrade to Apache Zeppelin 0.12.1, which resolves the injection flaw by properly escaping user-controlled input before incorporating it into LDAP search filter strings. The release is available at https://zeppelin.apache.org/ and the code change is documented in GitHub PR #5226 (https://github.com/apache/zeppelin/pull/5226). For environments where an immediate upgrade is not feasible, consider restricting access to the Zeppelin user-search endpoint at the network perimeter or via a reverse proxy to only trusted internal networks, reducing the population of users who can reach the vulnerable endpoint. Additionally, apply least-privilege to the LDAP service account used by Zeppelin - limit its bind scope to the minimum required organizational units and restrict attribute read permissions - so that any injected query retrieves the narrowest possible set of directory data. Disabling ActiveDirectoryGroupRealm and substituting a non-LDAP authentication mechanism (e.g., local file-based auth or a SAML/OIDC SSO provider) eliminates this attack surface entirely, at the cost of losing Active Directory group-based authorization and requiring reconfiguration of existing user roles.