Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN814
_____________________________________________________________________

DATE                : 04/08/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Zeppelin versions prior
                                     to 0.12.1.
 
=====================================================================
https://lists.apache.org/thread/s65t6n3s1v4j5b1w7zvv5w73ko69m1zv
https://lists.apache.org/thread/p6llqpvcszpg1wc8kx5ncfkdbms3g0rn
https://lists.apache.org/thread/ps1f0symnyxzq8c2dc3244v051jcwp40
https://lists.apache.org/thread/94trzcny14c1csgotsnkyrfsflt30b2c
_____________________________________________________________________

CVE-2026-44617: Apache Zeppelin: LDAP filter injection in LdapRealm
— incomplete fix of CVE-2024-31867

Severity: moderate 

Affected versions:

- Apache Zeppelin 0.11.1 before 0.12.1

Description:

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used
RFC 4514 distinguished-name escaping when constructing LDAP search
filters instead of RFC 4515 filter escaping, leaving special filter
characters insufficiently escaped. This is an incomplete fix of
CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1,
0.11.2, and 0.12.0. Users are recommended to upgrade to version
0.12.1, which fixes this issue.

Credit:

decsecre452 (finder)

References:

https://github.com/apache/zeppelin/pull/5226
https://www.cve.org/CVERecord?id=CVE-2024-31867
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-44617


_____________________________________________________________________

CVE-2026-44616: Apache Zeppelin: LDAP injection in
ActiveDirectoryGroupRealm filter construction

Severity: moderate 

Affected versions:

- Apache Zeppelin 0.6.0 before 0.12.1

Description:

LDAP injection vulnerability in Apache Zeppelin.
ActiveDirectoryGroupRealm constructed LDAP search filters without
escaping user-controlled input, allowing an authenticated attacker
to inject LDAP filter syntax through the user-search endpoint and
potentially expose directory information. The role-lookup path
was also affected after successful LDAP authentication. This issue
affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are
recommended to upgrade to version 0.12.1, which fixes this issue.

Credit:

Andrea Cosentino from Apache Software Foundation (finder)

References:

https://github.com/apache/zeppelin/pull/5226
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-44616

_____________________________________________________________________

CVE-2026-44615: Apache Zeppelin: Path traversal in NotebookRepo note
and folder path composition

Severity: low 

Affected versions:

- Apache Zeppelin 0.9.0 before 0.12.1

Description:

Path traversal vulnerability in Apache Zeppelin. When
FileSystemNotebookRepo is configured, an authenticated attacker with
permission to rename a note, or access to folder operations, could
supply traversal segments in note or folder paths. Zeppelin composed
these values into filesystem paths using the server's filesystem or
Hadoop identity without ensuring that the result remained under the
configured notebook directory. This could allow notebook files or
directories to be moved, written, or deleted outside the notebook
root. This issue affects Apache Zeppelin versions 0.9.0 through
0.12.0. Users are recommended to upgrade to version 0.12.1, which
fixes this issue.

Credit:

Green-m (finder)

References:

https://github.com/apache/zeppelin/pull/5227
https://github.com/apache/zeppelin/pull/5248
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-44615

_____________________________________________________________________

CVE-2026-44613: Apache Zeppelin: Cross-site request forgery in REST
and WebSocket request handling

Severity: moderate 

Affected versions:

- Apache Zeppelin 0.6.0 before 0.12.1

Description:

Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin.
The default CORS configuration allowed cross-origin state-changing
requests and accepted text/plain request bodies, allowing an attacker
who lures an authenticated user to a malicious site to perform actions
on the user's behalf through REST and WebSocket endpoints. This issue
affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are
recommended to upgrade to version 0.12.1, which fixes this issue.

Credit:

Reza (HazardLab Ninja) and Nir Zadok (finder)

References:

https://github.com/apache/zeppelin/pull/5229
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-44613


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================