Apache Zeppelin vulnerabilities

3 known vulnerabilities in Apache Zeppelin from Apache. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Zeppelin: Improper Control of a Resource Through its Lifetime

  CVE-2024-41169Jul 12, 2025Apache

  The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files. This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0. Users are recommended to upgrade to version 0.1

• 9.8 Critical severity

  Apache Zeppelin: Improper Encoding or Escaping of Output

  CVE-2024-31866Apr 9, 2024ApacheEPSS 1.58%

  Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1

• 9.8 Critical severity

  Apache Zeppelin: Improper Control of Generation of Code

  CVE-2024-31864Apr 9, 2024ApacheEPSS 1.26%

  Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Use