Cross-site Request Forgery (CSRF) Affecting org.apache.zeppelin:zeppelin-server package, versions [0.6.0,0.12.1)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHEZEPPELIN-18507727
- published2 Aug 2026
- disclosed30 Jul 2026
- creditUnknown
Introduced: 30 Jul 2026
NewCVE-2026-44613 (opens in a new tab)How to fix?
Upgrade org.apache.zeppelin:zeppelin-server to version 0.12.1 or higher.
Overview
org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the REST and WebSocket request-handling layer in CorsFilter, CorsUtils, and REST endpoint filtering. An attacker can make an authenticated user perform state-changing actions such as notebook or interpreter updates by luring them to a malicious site that sends cross-origin requests with a text/plain body or other browser-initiated requests against Zeppelin’s endpoints. The default origin allow-list permitted cross-origin browser access, and the REST layer accepted unsafe request content types on state-changing methods, so the server processed attacker-supplied requests with the victim’s session cookies. This lets the attacker trigger unauthorized changes on the user’s behalf through Zeppelin’s REST and WebSocket endpoints.