A CSRF flaw in Apache Zeppelin allows an attacker who lures an authenticated user to a malicious site to submit state‑changing requests to REST and WebSocket endpoints. The vulnerable default CORS configuration permits cross‑origin requests and accepts text/plain request bodies, so the attacker can instruct the user’s browser to perform actions such as creating notebooks, modifying configuration, or executing commands on the Zeppelin server. This weakness is captured by CWE‑352 and could lead to unauthorized data modification, service disruption, or compromise of the Zeppelin installation.

The vulnerability exists in Apache Zeppelin versions from 0.6.0 through 0.12.0, released by the Apache Software Foundation.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of <1% signals a very low probability of exploitation. The vulnerability is not listed in CISA KEV. However, the flaw offers a straightforward attack path: a malicious site can deliver cross‑origin requests to any authenticated Zeppelin user without additional authentication tokens or special host conditions. Because the CORS policy is permissive by default, the attacker requires only that the user visit the malicious site; no network or privileged access is needed.