Apache Zeppelin’s ActiveDirectoryGroupRealm does not escape user‑controlled input while building LDAP search filters, creating an LDAP injection vulnerability. An attacker who can authenticate to the system can submit crafted input to the user‑search endpoint, injecting arbitrary LDAP filter syntax. Successful exploitation can cause the system to return sensitive directory information that would normally be restricted, potentially revealing usernames, group memberships, or other directory data. The flaw also extends to the role‑lookup path after LDAP authentication, amplifying the exposure. The weakness is classified as CWE‑90.

Apache Zeppelin versions 0.6.0 through 0.12.0 are affected. The issue is resolved in version 0.12.1 and later.

The EPSS score is measured at less than 1%, indicating a low probability of exploitation. No public exploitation reports or KEV listing are present, and the vulnerability requires authenticated access. Consequently, the primary risk lies in confidentiality for users with legitimate access. In environments where the Zeppelin instance is open to a broader user base, the potential for exploitation is higher. The low EPSS suggests the likelihood is low, but the possible exposure of sensitive directory data warrants quick action.