OX Research found and disclosed a Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin

Vulnerability Details

CVE: CVE-2026-44613

Description: Apache Zeppelin’s default CORS configuration allowed cross-origin, credentialed, state-changing requests (and accepted text/plain request bodies), letting a remote attacker who lures an authenticated user to a malicious site perform unauthorized actions through Zeppelin’s REST and WebSocket endpoints.

CWE: CWE-352: Cross-Site request Forgery (CSRF)

CVSS Base score: 6.1

CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Overview

OX Research found and disclosed a Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin.

The vulnerability allows an attacker to perform unauthorized, state-changing actions on a victim’s behalf simply by setting the victim – a user who is already logged into Zeppelin – to visit an attacker-controlled webpage. No credentials, no extra clicks beyond loading the page, and no visible warning are required: the victim’s active Zeppelin session can be now controlled by the attacker without the victim ever noticing.

In the proof of concept we built and responsibly disclosed to the Apache Zeppelin security team, we demonstrated that this capability could be used to silently carry out unauthorized, administrative actions against a Zeppelin instance in our test environment – entirely from the browser of a logged-in test user, in the background, while that user believed they were simply reading an ordinary webpage.

The issue was published as CVE-2026-44613 and fixed in Apache Zeppelin 0.12.1.

About Apache Zeppelin

Apache Zeppelin is an open-source, web-based notebook for interactive data analytics, data engineering, and machine-learning workflows. A single browser-based notebook interface talks to dozens of pluggable language backends (“interpreters”) – Spark, Python, SQL, shell, and more – making it a common shared environment for exploring and processing data at scale.

Because a Zeppelin notebook can execute code and reach whatever data sources, credentials, and internal network segments its interpreters are configured with, a logged-in Zeppelin session is a high-value target: forging actions on behalf of that session can reach far beyond the browser tab it was opened in, which is exactly what this vulnerability allows.

Responsible Disclosure Timeline

Apr 13, 2026 – Initial disclosure
Jun 13, 2026- Fix released in Apache Zeppelin 0.12.1
Jul 30, 2026 – CVE-2026-44613 is assigned and the issue is made public

Technical Details

Apache Zeppelin’s CorsFilter had an internal logic to whether to honor a cross-origin request using an allow-list – which was defined under “zeppelin.server.allowed.origins”, by default, this allow list is set to * – which means any origin was accepted.

After our responsible disclosure, this was changed by default to empty, not allowing any cross-origin requests to pass through by default:

image

If a request’s header is allowed under the allowed origin list, any attacker could create a webpage that abuses this logic in order to control the server in the name of the victim’s account. This allows not only GET requests to pass through, but also other request types as well (POST, PUT, OPTIONS).

Some of the affected API endpoints in Apache Zeppelin also accepted plain-text request bodies, a content type that skips the preflight check entirely – a separate and even simpler way to reach the same endpoints regardless of the origin allow-list.

You can see in the patched code, catching unknown hosts in the local origin and throwing an error when they are found, instead of continuing regardless.

image

In our proof of concept, we built a page disguised as an ordinary article that, the moment a logged-in Zeppelin user opened it, silently issued a background sequence of forged, credentialed requests against real administrative endpoints.

Apache also added a hard-coded “application/json” header to remove the ability to send cleartext content to its API endpoints.

image

An attack scenario should look something like this: A threat actor sets up an innocent-looking webpage and lures a logged-in Zeppelin user into opening it, for example via a phishing link or a compromised ad. The victim sees nothing unusual, just an ordinary page. But in the background, hidden JavaScript uses their own active session to silently carry out unauthorized administrative actions against their Zeppelin instance, without their knowledge or consent.

By exploiting this vulnerability in our proof of concept, we were able to silently perform unauthorized administrative actions inside a local Zeppelin environment.

Proof of Concept Diagram

image

Affected Versions

Affected Product(s)

Version(s)

Apache Zeppelin

0.6.0 through 0.12.0

Remediation

To resolve this issue, upgrading to Apache Zeppelin version 0.12.1 is recommended.

The post CVE-2026-44613: Turning a CSRF into Silent Unauthorized Actions appeared first on OX Security.