CVE-2026-44613

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0

Description A Cross-Site Request Forgery (CSRF) issue exists due to a default CORS (Cross-Origin Resource Sharing) configuration that permits cross-origin state-changing requests and accepts text/plain request bodies. This allows an attacker to trick an authenticated user into visiting a malicious site to execute unauthorized actions via REST and WebSocket endpoints.

Recommendations Upgrade to version 0.12.1.