Apache Zeppelin’s LdapRealm constructs LDAP search filters using RFC 4514 distinguished‑name escaping instead of the correct RFC 4515 filter escaping. This leaves special filter characters insufficiently escaped, allowing LDAP filter injection. An attacker who supplies such characters through the authentication flow can influence the LDAP filter that Zeppelin submits to the directory server.

Apache Software Foundation’s Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 are vulnerable. The fix is available in version 0.12.1.

EPSS indicates a very low but non‑zero probability of exploitation, while a CVSS score of 6.5 denotes moderate severity. The vulnerability is not listed in CISA KEV. The attack vector is remote and can be exercised via the authentication interface that accepts user credentials. Based on the description, the injection occurs when user input reaches the filter construction during authentication, enabling an attacker to alter the LDAP query sent to the server.