CVE-2026-44615: Apache Zeppelin Path Traversal Flaw

CVE-2026-44615 Overview

CVE-2026-44615 is a path traversal vulnerability [CWE-22] in Apache Zeppelin affecting the FileSystemNotebookRepo notebook repository backend. An authenticated attacker with permission to rename notes or perform folder operations can supply traversal segments (such as ../) in note or folder paths. Zeppelin composes these values into filesystem paths using the server's filesystem or Hadoop identity without confirming the resulting path stays within the configured notebook directory. The flaw allows notebook files or directories to be moved, written, or deleted outside the notebook root. Apache Zeppelin versions 0.9.0 through 0.12.0 are affected, and version 0.12.1 contains the fix.

Critical Impact
Authenticated attackers can move, overwrite, or delete files outside the notebook root using the Zeppelin server or Hadoop process identity.

Affected Products

Apache Zeppelin 0.9.0 through 0.12.0 with FileSystemNotebookRepo configured
Deployments backed by local filesystem storage for notebooks
Deployments backed by Hadoop-compatible filesystems accessed through Zeppelin's server identity

Discovery Timeline

2026-07-31 - CVE-2026-44615 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-44615

Vulnerability Analysis

Apache Zeppelin exposes notebook rename and folder operations through its REST API and UI. When FileSystemNotebookRepo is configured as the notebook repository, Zeppelin persists notebooks as files under a configured notebook directory. The vulnerable code paths accept user-controlled note names and folder paths, then concatenate those values into filesystem paths without normalizing or validating that the resolved path remains inside the notebook root.

Because the operation runs under the Zeppelin server's filesystem identity (or its Hadoop identity when a Hadoop-compatible filesystem is used), the write, move, and delete operations execute with the privileges of the Zeppelin service account. That process identity often has broad read and write access to configuration files, logs, and other application data on the host.

The issue has an authenticated attack profile. Any account with permission to rename a note or perform folder operations qualifies as a valid attacker, which includes low-privileged notebook users on shared multi-tenant Zeppelin deployments.

Root Cause

The root cause is missing canonical path validation on user-supplied note and folder names. Zeppelin builds the target path by joining the notebook root with attacker-controlled segments, but never resolves the final path and checks that it is a descendant of the notebook root. Sequences such as ../ therefore escape the intended directory.

Attack Vector

An authenticated user issues a rename or folder operation over the network to the Zeppelin API. The request supplies a note or folder path containing traversal segments. Zeppelin resolves the path against the underlying filesystem and performs the requested move, write, or delete outside the notebook root. Refer to the Apache Zeppelin fix in Pull Request #5227 and Pull Request #5248 for the code-level details.

Detection Methods for CVE-2026-44615

Indicators of Compromise

Notebook rename or folder API requests containing ../, encoded traversal sequences such as %2e%2e%2f, or absolute paths in note or folder name fields.
Files or directories appearing, disappearing, or being modified outside the configured Zeppelin notebook root under the Zeppelin service account.
Zeppelin server logs showing rename or folder operations with unexpected target paths.

Detection Strategies

Review Zeppelin access logs and application logs for note rename and folder operation endpoints, and flag requests whose path parameters include traversal characters.
Compare the resolved filesystem targets of recent notebook operations against the configured notebook root, and alert on paths outside that root.
Baseline the file inventory of the notebook root and monitor for file creations, deletions, or renames triggered by the Zeppelin process outside that path.

Monitoring Recommendations

Forward Zeppelin application and web server logs to a centralized analytics platform for retention and correlation.
Monitor filesystem changes performed by the Zeppelin service account with host-based file integrity monitoring.
Track authentication and authorization events for Zeppelin accounts that hold rename or folder-management permissions.

How to Mitigate CVE-2026-44615

Immediate Actions Required

Upgrade Apache Zeppelin to version 0.12.1, which contains the fix for CVE-2026-44615.
Audit Zeppelin user accounts and remove rename or folder-operation permissions from users that do not require them.
Review the filesystem under the Zeppelin service account for unexpected file changes made during the exposure window.

Patch Information

The Apache Zeppelin project addresses CVE-2026-44615 in version 0.12.1. The upstream code changes are tracked in Pull Request #5227 and Pull Request #5248. Additional context is available in the Apache mailing list announcement and the Openwall oss-security discussion.

Workarounds

Restrict access to the Zeppelin instance to trusted users and require strong authentication for all accounts.
Run the Zeppelin process under a dedicated low-privilege service account with filesystem access scoped tightly to the notebook root.
Place Zeppelin behind an authenticating reverse proxy that inspects note and folder path parameters and rejects requests containing traversal sequences.

bash

# Configuration example: run Zeppelin as a low-privilege user with a scoped notebook root
# and confirm the version is 0.12.1 or later.
zeppelin-daemon.sh version
# Expected: Zeppelin version: 0.12.1

# conf/zeppelin-site.xml (excerpt)
# <property>
#   <name>zeppelin.notebook.storage</name>
#   <value>org.apache.zeppelin.notebook.repo.FileSystemNotebookRepo</value>
# </property>
# <property>
#   <name>zeppelin.notebook.dir</name>
#   <value>/var/lib/zeppelin/notebook</value>
# </property>

chown -R zeppelin:zeppelin /var/lib/zeppelin/notebook
chmod 750 /var/lib/zeppelin/notebook