Apache Zeppelin (Apache Software Foundation) - vulnerabilities (CVEs)
25 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-07-31. Vendor: Apache Software Foundation.
CVEs of Apache Zeppelin
- CVE-2026-44615 - CVSS 6.5 (medium), 2026-07-31: Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or…
- CVE-2026-44617 - CVSS 6.5 (medium), 2026-07-30: LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of…
- CVE-2026-44616 - CVSS 6.5 (medium), 2026-07-30: LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an…
- CVE-2026-44613 - CVSS 6.1 (medium), 2026-07-30: Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted…
- CVE-2024-51775 - CVSS 7.5 (high), 2025-08-03: Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any…
- CVE-2024-52279 - CVSS 7.5 (high), 2025-08-03: Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This…
- CVE-2024-41177 - CVSS 6.1 (medium), 2025-08-03: Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to…
- CVE-2024-41169 - CVSS 7.5 (high), 2025-07-12: The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This…
- CVE-2024-31867 - CVSS 6.5 (medium), 2024-04-09: Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration properties to LDAP…
- CVE-2024-31866 - CVSS 9.8 (critical), 2024-04-09: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding…
- CVE-2024-31865 - CVSS 6.5 (medium), 2024-04-09: Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook…
- CVE-2024-31864 - CVSS 9.8 (critical), 2024-04-09: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code…
- CVE-2024-31868 - CVSS 6.1 (medium), 2024-04-09: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This…
- CVE-2024-31863 - CVSS 5.3 (medium), 2024-04-09: Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before…
- CVE-2024-31862 - CVSS 5.3 (medium), 2024-04-09: Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before…
- CVE-2021-28656 - CVSS 5.4 (medium), 2024-04-09: Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects…
- CVE-2024-31860 - CVSS 6.5 (medium), 2024-04-09: Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the…
- CVE-2022-46870 - CVSS 5.4 (medium), 2022-12-16: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute…
- CVE-2021-28655 - CVSS 6.5 (medium), 2022-12-16: The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue…
- CVE-2021-27578 - CVSS 6.1 (medium), 2021-09-02: Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache…
- CVE-2020-13929 - CVSS 7.5 (high), 2021-09-02: Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue…
- CVE-2019-10095 - CVSS 9.8 (critical), 2021-09-02: bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects…
- CVE-2018-1317 - CVSS 8.8 (high), 2019-04-23: In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
- CVE-2017-12619 - CVSS 8.1 (high), 2019-04-23: Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
- CVE-2018-1328 - CVSS 6.1 (medium), 2019-04-23: Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph".
