CVE-2026-44617: Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Zeppelin (LdapRealm)to a version that resolves this vulnerability.Fixed in 0.12.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44617?
CVE-2026-44617 has a risk rating of 52.
What vulnerability does CVE-2026-44617 relate to?
CVE-2026-44617 is related to an incomplete fix of CVE-2024-31867 concerning LDAP filter injection.
How do I fix CVE-2026-44617?
To fix CVE-2026-44617, ensure Apache Zeppelin is updated to a version that properly implements RFC 4515 filter escaping.
What impact does CVE-2026-44617 have on Apache Zeppelin?
CVE-2026-44617 allows for LDAP filter injection due to insufficient escaping of special filter characters.
Is CVE-2026-44617 specific to a certain version of Apache Zeppelin?
Yes, CVE-2026-44617 affects versions of Apache Zeppelin prior to the patch that addresses the LDAP filter injection vulnerability.