CVE-2026-44613: Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/zeppelinto a version that resolves this vulnerability.Fixed in 0.12.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44613?
CVE-2026-44613 has a risk score of 52, indicating a medium severity level.
How do I fix CVE-2026-44613?
To fix CVE-2026-44613, ensure that your Apache Zeppelin configuration properly restricts CORS settings to prevent unauthorized cross-origin requests.
What type of attacks can be executed due to CVE-2026-44613?
CVE-2026-44613 allows attackers to perform Cross-Site Request Forgery attacks on behalf of authenticated users.
On which software does CVE-2026-44613 affect?
CVE-2026-44613 affects Apache Zeppelin, specifically in its REST and WebSocket request handling.
How can I determine if I'm vulnerable to CVE-2026-44613?
You may be vulnerable to CVE-2026-44613 if you are using Apache Zeppelin with the default CORS configurations that permit cross-origin state-changing requests.