EUVD-2026-51162
GHSA-853r-vxg2-55r2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
No prior auth needed at login endpoint; filter injection enables auth bypass (I:L) and LDAP directory enumeration (C:L); availability unaffected.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 1
AnalysisAI
LDAP filter injection in Apache Zeppelin's LdapRealm component allows remote attackers to manipulate LDAP search filter expressions by exploiting a wrong escaping scheme applied to user-supplied input during authentication. Versions 0.11.1, 0.11.2, and 0.12.0 incorrectly apply RFC 4514 distinguished-name escaping - which neutralizes DN metacharacters - instead of RFC 4515 filter-value escaping, leaving LDAP filter metacharacters such as parentheses, asterisks, and backslashes unsanitized in constructed search filters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that Apache Zeppelin is explicitly configured to use LdapRealm as its authentication provider, which is the multi-user LDAP configuration described in Zeppelin's documentation and is not enabled in default single-user deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector or CWE identifier was formally assigned in the advisory submission, requiring independent assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker submits a crafted username such as 'admin*)(uid=*))(|(uid=*' to the Zeppelin login page backed by LdapRealm, injecting RFC 4515 filter metacharacters that survive the incorrect RFC 4514 escaping. The manipulated string alters the LDAP search filter sent to the directory server - for example turning a filter like '(uid=<input>)' into a tautology that matches all users - enabling authentication bypass without valid credentials. … |
| Remediation | Upgrade Apache Zeppelin to version 0.12.1, which corrects the LdapRealm escaping logic to apply RFC 4515 filter-value encoding rather than RFC 4514 DN encoding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache Zeppelin deployments in versions 0.11.1, 0.11.2, and 0.12.0 and assess external network exposure; audit LDAP authentication configurations to determine attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P
Kanboard versions 1.2.48 and earlier contain an LDAP injection vulnerability where unsanitized user input in the LDAP au
Same weakness CWE-90 – LDAP Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today