Executive brief
Apache Zeppelin is a web-based notebook for data analysis and visualization. A security flaw in its Active Directory integration allows logged-in users to manipulate directory queries. This could allow an attacker to bypass intended search restrictions and view sensitive information about users and groups within the organization's directory service.
Technical details
An LDAP injection vulnerability exists in Apache Zeppelin's ActiveDirectoryGroupRealm and LdapRealm components. The root cause is the failure to properly escape user-controlled input when constructing LDAP search filters and Distinguished Names (DNs), specifically failing to adhere to RFC 4515 and RFC 4514 escaping requirements. An authenticated attacker can exploit this via the user-search endpoint or during role-lookup to inject LDAP filter metacharacters (such as *, (, and )). This allows for the manipulation of search logic to extract unauthorized directory information. The issue is fixed in version 0.12.1 by implementing proper context-aware escaping for filter values and DN templates.
Affected products
- Apache Zeppelin 0.6.0 through 0.12.0
Timeline
- 2026-05-14: patched: Pull request merged into master branch
- 2026-07-30: disclosed: Public announcement on oss-security mailing list
- 2026-07-30: advisory: NVD publication date