PatchTheCEVCVE-2026-44613: Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin
34
Routine
MEDIUM 6.1WATCHLISTUPGRADE
CVE-2026-44613 is a medium-severity flaw (CVSS 6.1) affecting zeppelin. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrad
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2026-07-30 |
| Last modified | 2026-10-23 |
Publisher (CNA): Apache Software Foundation · Vendor: apache
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
apache zeppelin UPGRADE
Affected: >= 0.6.0 and < 0.12.1
Fixed in: 0.12.1
Safe to downgrade to: a release before 0.6.0
1. Check installed version
apt-cache policy zeppelin || rpm -q zeppelin || zeppelin --version
2. UPGRADE to 0.12.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade zeppelin
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade zeppelin
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.6.0 (Debian / Ubuntu)
apt-cache madison zeppelin
sudo apt install zeppelin=<VERSION_BEFORE_0.6.0>
sudo apt-mark hold zeppelin
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list zeppelin
sudo dnf downgrade zeppelin-<VERSION_BEFORE_0.6.0>
sudo dnf versionlock add zeppelin
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-44615 MEDIUM 6.5 UPGRADE Path traversal vulnerability in Apache Zeppelin
- CVE-2026-44617 MEDIUM 6.5 UPGRADE LDAP filter injection vulnerability in Apache Zeppelin
- CVE-2026-44616 MEDIUM 6.5 UPGRADE LDAP injection vulnerability in Apache Zeppelin