CVE-2026-44617

EUVD-2026-51162

30.07.2026, 16:17

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped.                   This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

LDAP Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 42.46%

Affected Products (NVD)

Vendor	Product	Version
apache	zeppelin	0.11.1 ≤ 𝑥 < 0.12.1

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

References

https://github.com/apache/zeppelin/pull/5226

https://lists.apache.org/thread/s65t6n3s1v4j5b1w7zvv5w73ko69m1zv

https://www.cve.org/CVERecord?id=CVE-2024-31867