Apache Zeppelin vulnerabilities

• apache zeppelin Path traversal in NotebookRepo note and folder path composition CVE-2026-44615 6.5 MediumJuly 31, 2026
• apache zeppelin Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 CVE-2026-44617 6.5 MediumJuly 30, 2026
• apache zeppelin Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction CVE-2026-44616 6.5 MediumJuly 30, 2026
• apache zeppelin Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling CVE-2026-44613 Public exploit 6.1 MediumJuly 30, 2026
• apache zeppelin Apache Zeppelin: Command Injection via CSWSH CVE-2024-51775 Fix available 5.3 MediumAugust 3, 2025
• apache zeppelin Apache Zeppelin: XSS in the Helium module CVE-2024-41177 Fix available 6.1 MediumAugust 3, 2025
• apache zeppelin Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string CVE-2024-52279 Fix available 5.3 MediumAugust 3, 2025
• apache zeppelin Apache Zeppelin: raft directory listing and file read CVE-2024-41169 Fix available 7.5 HighJuly 12, 2025
• apache zeppelin Apache Zeppelin: LDAP search filter query Injection Vulnerability CVE-2024-31867 Fix available 6.5 MediumApril 9, 2024
• apache zeppelin Apache Zeppelin: XSS vulnerability in the helium module CVE-2024-31868 Fix available 6.1 MediumApril 9, 2024
• apache zeppelin Apache Zeppelin: Interpreter download command does not escape malicious code injection CVE-2024-31866 Fix available 9.8 CriticalApril 9, 2024
• apache zeppelin Apache Zeppelin: Cron arbitrary user impersonation with improper privileges CVE-2024-31865 Fix available 6.5 MediumApril 9, 2024
• apache zeppelin Apache Zeppelin: Remote code execution by adding malicious JDBC connection string CVE-2024-31864 Fix available 9.8 CriticalApril 9, 2024
• apache zeppelin Apache Zeppelin: Replacing other users notebook, bypassing any permissions CVE-2024-31863 Fix available 5.3 MediumApril 9, 2024
• apache zeppelin Apache Zeppelin: Denial of service with invalid notebook name CVE-2024-31862 Fix available 5.3 MediumApril 9, 2024
• apache zeppelin, apache software foundation zeppelin sap +1 more Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE CVE-2022-47894 Fix available 5.3 MediumApril 9, 2024
• apache zeppelin Apache Zeppelin: CSRF vulnerability in the Credentials page CVE-2021-28656 5.4 MediumApril 9, 2024
• apache zeppelin Apache Zeppelin: Path traversal vulnerability CVE-2024-31860 Fix available 6.5 MediumApril 9, 2024
• apache zeppelin Apache Zeppelin: Stored XSS in note permissions CVE-2022-46870 Fix available 5.4 MediumDecember 16, 2022
• apache zeppelin Apache Zeppelin: Arbitrary file deletion vulnerability CVE-2021-28655 Fix available 6.5 MediumDecember 16, 2022
• apache zeppelin Cross Site Scripting in markdown interpreter CVE-2021-27578 Fix available 6.1 MediumSeptember 2, 2021
• apache zeppelin Notebook permissions bypass CVE-2020-13929 Fix available 7.5 HighSeptember 2, 2021
• apache zeppelin bash command injection in spark interpreter CVE-2019-10095 Fix available 9.8 CriticalSeptember 2, 2021
• apache zeppelin Cross-site Scripting in Apache Zeppelin CVE-2018-1328 Fix available 6.1 MediumApril 23, 2019
• apache zeppelin Improper Authentication in Apache Zeppelin CVE-2018-1317 Fix available 8.8 HighApril 23, 2019
• apache zeppelin Session Fixation in Apache Zeppelin CVE-2017-12619 Fix available 8.1 HighApril 23, 2019