Dashboard / CVE-2026-44617

CVE-2026-44617

MEDIUM
MEDIUM Priority: 0.05 BB Relevance: 73/100
Published: 2026-07-30 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped.                   This is an incomplete fix of CVE-2024-31867. This issue affects Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
apache zeppelin 0.11.1 – 0.12.1

References & Advisories (3)

https://www.cve.org/CVERecord?id=CVE-2024-31867
Mailing List Third Party Advisory

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

0.84%
Raw Score 0.008380
Percentile 57.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00838
2026-10-28
0.00838

Intelligence Sources

nvd ref →

External Links