CVE-2026-44616

Katalog CVE

CVSS 6.5 · Medium EPSS 0,76%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada apache zeppelin. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint                   and potentially expose directory information. The role-lookup path was also affected after successful LDAP authentication. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which                   fixes this issue.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/p6llqpvcszpg1wc8kx5ncfkdbms3g0rn mailing list · advisory vendor
• https://github.com/apache/zeppelin/pull/5226 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/07/30/3 mailing list · advisory pihak ketiga