Is CVE-2026-44617 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44617 being exploited in the wild.

How severe is CVE-2026-44617?

Informational severity, with a CVSS score of 0, published 30 July 2026.

Which products and versions are affected?

Apache Software Foundation Zeppelin 0.11.1, 0.11.2, 0.12.0.

Is there a fix for CVE-2026-44617?

A patch was published on 2026-05-14: Fix merged into master branch via PR 5226 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44617 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44617?

Check whether you run Apache Software Foundation Zeppelin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44617: Apache Zeppelin LDAP filter injection in LdapRealm

CVE-2026-44617 · Severity: info · CVSS 0 · Published 2026-07-30

Apache Zeppelin, a web-based notebook for data analytics, contains a security flaw in how it handles user logins via LDAP. The system fails to properly sanitize user-provided input when searching for users or groups in a directory service, which could allow an attacker to manipulate login queries. This could potentially lead to unauthorized access or the bypass of intended security restrictions.

Technologies: Apache Software Foundation Zeppelin. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-44617 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44617 being exploited in the wild.
How severe is CVE-2026-44617?: Informational severity, with a CVSS score of 0, published 30 July 2026.
Which products and versions are affected?: Apache Software Foundation Zeppelin 0.11.1, 0.11.2, 0.12.0.
Is there a fix for CVE-2026-44617?: A patch was published on 2026-05-14: Fix merged into master branch via PR 5226 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44617 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44617?: Check whether you run Apache Software Foundation Zeppelin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Apache Zeppelin's LdapRealm and ActiveDirectoryGroupRealm components are vulnerable to LDAP filter injection. The root cause is the use of RFC 4514 (Distinguished Name) escaping for LDAP search filters instead of the required RFC 4515 escaping, or in some cases, a total lack of escaping. This allows metacharacters such as '(', ')', and '*' to remain unescaped when interpolated into filter templates. An attacker can exploit this by providing specially crafted usernames or input to manipulate the LDAP query logic. This is an incomplete fix for a previous vulnerability (CVE-2024-31867) and is resolved in version 0.12.1 by implementing proper RFC 4515 escaping.

Affected products

Apache Software Foundation Zeppelin 0.11.1, 0.11.2, 0.12.0

Timeline

2026-05-14: patched: Fix merged into master branch via PR 5226
2026-07-30: disclosed: Public advisory published by Apache

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.