Skip to content

Apache Zeppelin CVE-2026-44613 CSRF into unauthorized notebook actions

Summary

OX Security disclosed CVE-2026-44613, a cross-site request forgery (CWE-352) in Apache Zeppelin, the web-based data analytics notebook. Apache Zeppelin 0.6.0 through 0.12.0 are affected; the issue was fixed in 0.12.1.

  • CVSS 6.1 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • Root cause: Zeppelin's CorsFilter defaulted the origin allow-list (zeppelin.server.allowed.origins) to *, accepting credentialed, state-changing cross-origin requests (POST/PUT/OPTIONS) from any origin.
  • Amplifier: some Zeppelin REST/WebSocket endpoints accepted text/plain request bodies, a content type that skips the CORS preflight check entirely, letting an attacker reach those endpoints regardless of the origin allow-list.

The result: an attacker who lures an authenticated Zeppelin user to a malicious page (phishing link, compromised ad) can silently issue forged, credentialed requests against the victim's own session and perform unauthorized — including administrative — actions against the victim's Zeppelin instance, without credentials and without the victim noticing.

Tags

Why this matters

  • Zeppelin notebooks execute code and reach whatever data sources, credentials, and internal network segments their interpreters (Spark, Python, SQL, shell) are configured with. A logged-in session is therefore a high-value target: forging actions on its behalf reaches far beyond the browser tab in which the attack page is open (the S:C scope change in the CVSS vector).
  • The flaw is a default-configuration problem, not a rare misconfiguration: the shipped allow-list was *, so out-of-the-box Zeppelin deployments that expose the UI to a browser are exposed until patched or reconfigured.
  • The text/plain-body path makes the CORS allow-list partially moot on affected endpoints, so "restrict allowed origins" alone does not fully close the primitive on unpatched versions.
  • Unlike many unauthenticated RCEs, this requires an authenticated victim to be present, which keeps the base score at High rather than Critical — but for an organization running an internal Zeppelin with many authenticated analysts, that is a wide and reachable victim pool.

Technical detail

Zeppelin's CorsFilter decides whether to honor a cross-origin request from an allow-list defined by zeppelin.server.allowed.origins. By default that list was *, so every origin was accepted. When an origin passes the check, the browser is allowed to send credentialed, state-changing requests (POST/PUT/OPTIONS) cross-origin against Zeppelin's REST and WebSocket endpoints, not just reads.

Independently, some affected endpoints accepted plain-text (text/plain) request bodies. A text/plain body does not trigger a CORS preflight, so an attacker page can send it directly from a cross-origin context without the allow-list check gating it.

The fix (0.12.1) makes two changes: 1. The zeppelin.server.allowed.origins default changed from * to empty, so no cross-origin requests pass by default. 2. A hard-coded application/json content-type expectation was added to the API so that cleartext text/plain bodies are no longer accepted, removing the preflight-bypass path.

The patched code also catches unknown hosts in the local-origin handling and errors out instead of proceeding.

OX's proof of concept was a page disguised as an ordinary article: the moment a logged-in Zeppelin user opened it, hidden JavaScript issued a background sequence of forged, credentialed requests against real administrative endpoints, silently performing unauthorized administrative actions in OX's local test environment.

Affected and patched versions

Product Affected versions Patched version
Apache Zeppelin 0.6.0 – 0.12.0 0.12.1

Disclosure timeline

  • Apr 13, 2026 — Initial disclosure to the Apache Zeppelin security team.
  • Jun 13, 2026 — Fix released in Apache Zeppelin 0.12.1.
  • Jul 30, 2026 — CVE-2026-44613 assigned and made public.
  • Aug 6, 2026 — OX Security published the analysis.

Defender priorities

  1. Upgrade to Apache Zeppelin 0.12.1 (or apply the zeppelin.server.allowed.origins restriction plus JSON-only content type if you cannot upgrade immediately). This is the definitive remediation.
  2. Reconfigure zeppelin.server.allowed.origins on any version you run: set it to the specific origins that need to reach the API, never *. This alone does not close the text/plain preflight-bypass on unpatched builds.
  3. Treat Zeppelin as a high-value authenticated target. Because notebooks can execute arbitrary interpreters and reach internal data, a forged administrative action is not just a UI nuisance — prioritize internet-facing and broadly accessible Zeppelin deployments.
  4. Hunt for forged administrative actions. Look for administrative endpoint requests (notebook, interpreter, and configuration management) arriving from sessions whose browser referrer/origin does not match Zeppelin's own origin, especially around any phishing or drive-by activity targeting users with Zeppelin access.
  5. Re-check KEV status on each scan. As of the last scan, CVE-2026-44613 is not in the CISA KEV catalog and no actor or exploitation infrastructure is reported; the durable record is the OX writeup and the 0.12.1 fix.

Assessment limits

  • Reported through responsible disclosure; OX Security built and disclosed the PoC. No public exploitation, mass-infrastructure, or actor linkage has been reported as of the last scan.
  • CISA KEV status: not listed as of the last scan. Re-check on each scan.
  • The vulnerability mechanics above are as described in the OX Security analysis; version range and CVSS are from the Apache Zeppelin disclosure.

Sources