---
id: CVE-2026-44613
title: Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin
summary: >-
  Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The
  default CORS configuration allowed cross-origin state-changing requests and
  accepted text/plain request bodies, allowing an attacker who lures an
  authenticated user …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-352
vendor: apache
product: zeppelin
affected:
  - 'zeppelin >= 0.6.0, < 0.12.1'
patched:
  - zeppelin 0.12.1
published: '2026-07-30'
updated: '2026-08-07'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44613'
references:
  - url: 'https://github.com/apache/zeppelin/pull/5229'
    label: security@apache.org
  - url: 'https://lists.apache.org/thread/94trzcny14c1csgotsnkyrfsflt30b2c'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/07/30/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.ox.security/blog/cve-2026-44613-turning-a-csrf-into-silent-unauthorized-actions/
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.00387
epssPercentile: 0.29973
ingestedAt: '2026-08-08T13:22:52.639Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/HORKimhab/CVE-2026-44613'
  checkedAt: '2026-09-25T08:20:57.675Z'
exploitAvailable: true
---

## Overview

Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a                   malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

## Affected

- `zeppelin >= 0.6.0, < 0.12.1`

## Remediation

Upgrade past the affected range:

- `zeppelin 0.12.1`