Executive brief
Apache Zeppelin, a web-based notebook for data analytics and visualization, contains a security flaw in its default configuration. An attacker could trick a logged-in user into visiting a malicious website, which then silently performs actions in Zeppelin using the user's active session. This could allow unauthorized changes to data notebooks, system settings, or other administrative actions, potentially compromising sensitive data or system integrity.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Zeppelin versions 0.6.0 through 0.12.0. The root cause is a permissive default CORS configuration that allowed cross-origin state-changing requests (POST, PUT, DELETE, PATCH) and accepted 'text/plain' request bodies, which bypasses standard browser CORS preflight protections. An attacker can exploit this by luring an authenticated user to a malicious site that sends forged requests to the Zeppelin REST or WebSocket endpoints. Successful exploitation allows the attacker to perform state-changing actions with the victim's privileges. The issue is resolved in version 0.12.1 by tightening origin validation, restricting accepted Content-Types, and setting 'SameSite=Lax' for session cookies.
Affected products
- Apache Zeppelin 0.6.0 through 0.12.0
Timeline
- 2026-05-18: patched: GitHub pull request merged to harden CORS and request handling
- 2026-07-30: disclosed: Public disclosure via oss-security mailing list
- 2026-07-30: advisory: NVD publication date