PT-2026-66504 · Apache+1 · Apache Zeppelin+1

Decsecre452

·

CVE-2026-44617

·

Published

2026-07-30

·

Updated

2026-07-31

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.11.1 through 0.12.0
Description An LDAP filter injection issue exists in the LdapRealm component. The system incorrectly applied RFC 4514 distinguished-name escaping instead of RFC 4515 filter escaping when constructing LDAP search filters, which resulted in special filter characters being insufficiently escaped.
Recommendations Upgrade to version 0.12.1.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-44617

Affected Products

Apache Zeppelin
Zeppelin