Silent Hijacking: Apache Zeppelin's CSRF Vulnerability Our Nir Za disclosed a CSRF vulnerability in Apache Zeppelin (CVE-2026-44613) that let attackers forge credentialed requests on behalf of logged-in users. One innocent web page is all that you need, if the Apache Zeppelin user has his local service running in the background, a malicious external site could execute hidden JavaScript code and run as the user on the Apache Zeppelin server. A victim would not notice a thing - while his whole Apache Zeppelin server is compromised. And the fix was so simple - Apache changed the default CORS configuration from allow all to deny by default - a single * needed to be removed to block this attack surface by default. If you're running Zeppelin 0.6.0 - 0.12.0, upgrade to 0.12.1. Full technical details: https://www.ox.security/blog/cve-2026-44613-turning-a-csrf-into-silent-unauthorized-actions/
Post summary
The post discloses CVE-2026-44613, a CSRF vulnerability in Apache Zeppelin, and provides specific mitigation by updating CORS settings and upgrading to 0.12.1.
