Executive brief
Apache Zeppelin, a web-based notebook for data analytics, contains a security flaw in how it handles user logins via LDAP. The system fails to properly sanitize user-provided input when searching for users or groups in a directory service, which could allow an attacker to manipulate login queries. This could potentially lead to unauthorized access or the bypass of intended security restrictions.
Technical details
Apache Zeppelin's LdapRealm and ActiveDirectoryGroupRealm components are vulnerable to LDAP filter injection. The root cause is the use of RFC 4514 (Distinguished Name) escaping for LDAP search filters instead of the required RFC 4515 escaping, or in some cases, a total lack of escaping. This allows metacharacters such as '(', ')', and '*' to remain unescaped when interpolated into filter templates. An attacker can exploit this by providing specially crafted usernames or input to manipulate the LDAP query logic. This is an incomplete fix for a previous vulnerability (CVE-2024-31867) and is resolved in version 0.12.1 by implementing proper RFC 4515 escaping.
Affected products
- Apache Software Foundation Zeppelin 0.11.1, 0.11.2, 0.12.0
Timeline
- 2026-05-14: patched: Fix merged into master branch via PR 5226
- 2026-07-30: disclosed: Public advisory published by Apache