Is CVE-2026-44616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44616 being exploited in the wild.

How severe is CVE-2026-44616?

Informational severity, with a CVSS score of 0, published 30 July 2026.

Which products and versions are affected?

Apache Software Foundation Zeppelin 0.6.0 through 0.12.0.

Is there a fix for CVE-2026-44616?

A patch was published on 2026-05-14: Pull request merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44616 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44616?

Check whether you run Apache Software Foundation Zeppelin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44616: Apache Zeppelin LDAP injection in ActiveDirectoryGroupRealm

CVE-2026-44616 · Severity: info · CVSS 0 · Published 2026-07-30

Apache Zeppelin is a web-based notebook for data analysis and visualization. A security flaw in its Active Directory integration allows logged-in users to manipulate directory queries. This could allow an attacker to bypass intended search restrictions and view sensitive information about users and groups within the organization's directory service.

Technologies: Apache Software Foundation Zeppelin. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-44616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44616 being exploited in the wild.
How severe is CVE-2026-44616?: Informational severity, with a CVSS score of 0, published 30 July 2026.
Which products and versions are affected?: Apache Software Foundation Zeppelin 0.6.0 through 0.12.0.
Is there a fix for CVE-2026-44616?: A patch was published on 2026-05-14: Pull request merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44616 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44616?: Check whether you run Apache Software Foundation Zeppelin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An LDAP injection vulnerability exists in Apache Zeppelin's ActiveDirectoryGroupRealm and LdapRealm components. The root cause is the failure to properly escape user-controlled input when constructing LDAP search filters and Distinguished Names (DNs), specifically failing to adhere to RFC 4515 and RFC 4514 escaping requirements. An authenticated attacker can exploit this via the user-search endpoint or during role-lookup to inject LDAP filter metacharacters (such as *, (, and )). This allows for the manipulation of search logic to extract unauthorized directory information. The issue is fixed in version 0.12.1 by implementing proper context-aware escaping for filter values and DN templates.

Affected products

Apache Zeppelin 0.6.0 through 0.12.0

Timeline

2026-05-14: patched: Pull request merged into master branch
2026-07-30: disclosed: Public announcement on oss-security mailing list
2026-07-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.