CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

What is CVE-2026-44613?

CVE-2026-44613 is a medium-severity vulnerability in Apache Zeppelin, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a                   malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Weakness: CWE-352

Which versions are affected by CVE-2026-44613?

It affects 1 product.

Products include Apache Zeppelin.

How do I fix CVE-2026-44613?

No fix has been published for CVE-2026-44613 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-44613 being exploited?

There is no known exploitation of CVE-2026-44613 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Zeppelin

• CVE-2024-31864 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string Critical 9.8
• CVE-2024-31866 Apache Zeppelin: Interpreter download command does not escape malicious code injection Critical 9.8
• CVE-2019-10095 bash command injection in spark interpreter Critical 9.8
• CVE-2018-1317 Improper Authentication in Apache Zeppelin High 8.8
• CVE-2017-12619 Session Fixation in Apache Zeppelin High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3w7g-q5x7-jg2r.