LDAP Injection in Apache Software Foundation Zeppelin
CVE-2026-44617
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped…
Affected products
- Apache Software Foundation Zeppelin — versions 0.11.1
Weakness classification (CWE)
References
- security@apache.org (patch)
- security@apache.org
- security@apache.org (vendor-advisory)