CVE-2026-44616 in Zeppelin
Summary
by MITRE • 07/30/2026
LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory information. The role-lookup path was also affected after successful LDAP authentication. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
Apache Zeppelin contains a critical ldap injection vulnerability that stems from improper input sanitization in the ActiveDirectoryGroupRealm component. The vulnerability manifests when constructing ldap search filters for user authentication and role lookup operations. Specifically, the system fails to properly escape user-controlled input before incorporating it into ldap filter syntax, creating an avenue for malicious manipulation of the underlying directory service queries.
The technical flaw resides in how the application processes user-search endpoint requests where ldap search filters are dynamically constructed without adequate sanitization of input parameters. This creates a classic injection vector where an authenticated attacker can manipulate the ldap query structure by injecting ldap filter syntax elements such as parentheses, wildcards, or logical operators. The vulnerability affects both the initial user-search functionality and subsequent role-lookup operations that occur after successful authentication, expanding the potential impact beyond simple information disclosure.
The operational impact of this vulnerability extends beyond mere data exposure, as it enables attackers to craft malicious ldap queries that could potentially enumerate directory users, access sensitive group memberships, or even bypass authentication mechanisms entirely. Attackers can exploit this weakness to gain unauthorized access to directory information, escalate privileges within the zeppelin environment, and potentially move laterally within the network infrastructure that relies on active directory for authentication services. The vulnerability affects a substantial range of apache zeppelin versions from 0.6.0 through 0.12.0, making it particularly concerning given the widespread adoption of this data analytics platform.
The remediation strategy centers on upgrading to apache zeppelin version 0.12.1 which implements proper input escaping mechanisms for ldap filter construction. Organizations should also implement additional security controls including network segmentation, monitoring of ldap query patterns, and regular security assessments of authentication components. This vulnerability aligns with cwe-91 for improper neutralization of special elements used in an ldap injection attack and maps to att&ck technique t1078 for valid accounts and t1531 for execute non-executable code. Security teams should conduct thorough testing of the patched version to ensure proper input sanitization and verify that all ldap query construction paths are adequately protected against similar injection attacks.