What is the CVSS score of CVE-2026-44617?

CVE-2026-44617 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Zeppelin are affected by CVE-2026-44617?

Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 contain a critical LDAP authentication bypass vulnerability that allows remote attackers to manipulate LDAP filter expressions and gain…. A patch is available.

How to fix or mitigate CVE-2026-44617?

Within 24 hours, identify all Apache Zeppelin deployments in versions 0.11.1, 0.11.2, and 0.12.0 and assess external network exposure; audit LDAP authentication configurations to determine attack surface. Within 7 days, implement network isolation by placing affected Zeppelin instances behind VPN or IP whitelisting, disable LDAP authentication if feasible and switch to alternative authentication methods (API keys, local user accounts, or SAML), and enable enhanced logging on LDAP servers to detect exploitation attempts. Within 30 days, continuously monitor vendor advisories for a patched version release and develop an upgrade plan; prepare to migrate to an unaffected Zeppelin version or alternative product once patches become available.

Apache Zeppelin CVE-2026-44617

EUVD-2026-51162 MEDIUM

LDAP Injection (CWE-90)

2026-07-30

GHSA-853r-vxg2-55r2

Apache LDAP Code Injection Zeppelin

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

No prior auth needed at login endpoint; filter injection enables auth bypass (I:L) and LDAP directory enumeration (C:L); availability unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 31, 2026 - 18:37 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 16:03 EUVD

Analysis Generated

Jul 30, 2026 - 12:18 vuln.today

CVE Published

Jul 30, 2026 - 11:12 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical LDAP Injection in Apache Zeppelin LdapRealm - CVE-2026-44617 Jul 30, 2026

AnalysisAI

LDAP filter injection in Apache Zeppelin's LdapRealm component allows remote attackers to manipulate LDAP search filter expressions by exploiting a wrong escaping scheme applied to user-supplied input during authentication. Versions 0.11.1, 0.11.2, and 0.12.0 incorrectly apply RFC 4514 distinguished-name escaping - which neutralizes DN metacharacters - instead of RFC 4515 filter-value escaping, leaving LDAP filter metacharacters such as parentheses, asterisks, and backslashes unsanitized in constructed search filters. This is an incomplete fix of CVE-2024-31867; no public exploit has been identified at time of analysis.

Technical ContextAI

Apache Zeppelin is a web-based data analytics notebook that supports multi-user deployments via LDAP/Active Directory authentication through its LdapRealm module (backed by Apache Shiro). When a user logs in, Zeppelin constructs an LDAP search filter incorporating the user-supplied username (and potentially password) to locate the user's directory entry. The vulnerability stems from a standards confusion: RFC 4514 governs escaping within LDAP Distinguished Names, while RFC 4515 governs escaping within LDAP search filter value assertions. The two standards define different metacharacter sets - RFC 4515 requires that characters including '(', ')', '*', '\', and null bytes be escaped as \XX hex sequences inside filter values. By applying RFC 4514 DN-escaping to filter values, Zeppelin leaves RFC 4515 filter metacharacters intact, allowing an attacker-controlled string to break out of its filter value context and modify the filter logic. The root cause class is LDAP injection (analogous to SQL injection but for LDAP queries), and this CVE represents a bypass of the incomplete prior fix applied for CVE-2024-31867.

RemediationAI

Upgrade Apache Zeppelin to version 0.12.1, which corrects the LdapRealm escaping logic to apply RFC 4515 filter-value encoding rather than RFC 4514 DN encoding. The upstream fix is in GitHub pull request #5226 (https://github.com/apache/zeppelin/pull/5226), and 0.12.1 is confirmed as the current release per https://zeppelin.apache.org/. If immediate upgrade is not feasible, disable LdapRealm and switch to an alternative Zeppelin authentication provider - note this disrupts existing LDAP-based user management and session mappings. As a secondary control, restrict network access to the Zeppelin web interface (typically port 8080) to trusted internal networks only, which limits the attack surface to already-authenticated network segments; this does not eliminate the vulnerability but reduces exposure. Monitoring LDAP server query logs for anomalous filter patterns (unexpected parentheses, wildcards, or null bytes originating from Zeppelin) can serve as a detection control. Release notes are available at https://zeppelin.apache.org/.