CVE-2026-44617

Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

State: Published
Severity: 6.5 Medium
Published: Jul 30, 2026
Updated: Jul 31, 2026
Reserved: May 7, 2026

Description

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	CISA-ADP

Weaknesses

CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Affected Products

Product	Versions
Apache ZeppelinApache Software Foundation	0.11.1 to before 0.12.1Affected

References

Apache Zeppelin PR #5226patch
CVE-2024-31867 (incomplete fix)
https://lists.apache.org/thread/s65t6n3s1v4j5b1w7zvv5w73ko69m1zvvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.