CVE-2026-44615: path traversal escapes notebook

CISO Take

Apache Zeppelin's FileSystemNotebookRepo fails to confine note and folder rename/move operations to the configured notebook directory, letting an already-authenticated user with note-rename or folder-operation permission supply traversal segments ('../') to move, write, or delete files outside the notebook root using the server's own filesystem or Hadoop identity. There is no CVSS score, EPSS data, CISA KEV listing, public exploit, or Nuclei template for this issue, so there is no evidence of active or automated exploitation, and it requires an existing authenticated foothold rather than being remotely exploitable by an anonymous attacker. The real risk sits in shared, multi-tenant Zeppelin deployments used for interactive data science and ML development, where a lower-privileged authenticated user could tamper with other users' notebooks or service-account-reachable files, potentially leading to malicious code landing in paragraphs later executed by higher-privileged interpreters or teammates. Patch to Apache Zeppelin 0.12.1 as soon as feasible; until then, restrict note-rename and folder-operation permissions to trusted/admin roles and audit the FileSystemNotebookRepo storage path for files or directories that have landed outside the configured notebook directory.

Sources: NVD lists.apache.org openwall.com ATLAS

What is the risk?

No CVSS vector or EPSS score is available, and the issue is not in CISA KEV, has no public exploit code, and no Nuclei scanner coverage, so near-term mass exploitation is unlikely. However, exploitability is not trivial to dismiss: any authenticated user who has been granted note-rename or folder-operation rights — a common permission in collaborative Zeppelin instances — can trigger the traversal without needing further privilege escalation or complex tooling, making this a moderate, insider-adjacent risk. Impact is potentially severe in shared multi-tenant environments because writes/deletes execute under the server's filesystem or Hadoop service identity, meaning the attacker's effective reach extends beyond their own notebook permissions to whatever the service account can touch.

How does the attack unfold?

Initial Access

Attacker authenticates with an existing account that has note-rename or folder-operation permission on the Zeppelin instance.

AML.T0012

Path Traversal Exploitation

Attacker supplies traversal segments ('../') in the note or folder path during a rename/move operation; Zeppelin composes the filesystem path without confining it to the configured notebook directory.

Unauthorized File Write/Move/Delete

Using the server's filesystem or Hadoop service identity, the traversal causes notebook files or directories to be moved, written, or deleted outside the notebook root.

Impact

Attacker overwrites another user's notebook with malicious paragraphs later executed by that user or an interpreter, or deletes reachable files, resulting in code execution or denial of service in the shared ML environment.

AML.T0050

Initial Access

Attacker authenticates with an existing account that has note-rename or folder-operation permission on the Zeppelin instance.

AML.T0012

Path Traversal Exploitation

Attacker supplies traversal segments ('../') in the note or folder path during a rename/move operation; Zeppelin composes the filesystem path without confining it to the configured notebook directory.

Unauthorized File Write/Move/Delete

Using the server's filesystem or Hadoop service identity, the traversal causes notebook files or directories to be moved, written, or deleted outside the notebook root.

Impact

Attacker overwrites another user's notebook with malicious paragraphs later executed by that user or an interpreter, or deletes reachable files, resulting in code execution or denial of service in the shared ML environment.

AML.T0050

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade to Apache Zeppelin 0.12.1, which fixes the path confinement bug. If immediate patching isn't possible, restrict the permission to rename notes/folders or perform folder operations to trusted administrators only, and review Zeppelin's authorization configuration (shiro.ini / notebook authorization settings) for over-broad grants. Audit the configured notebook directory and its parent paths for files or subdirectories that don't belong there, which would indicate prior exploitation. Add monitoring/logging around note and folder rename API calls for path segments containing '../' or absolute paths, and review the server's filesystem/Hadoop service account permissions to ensure it has no more filesystem access than the notebook directory requires (principle of least privilege for the service identity itself).

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution DoS Framework AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.7 - AI System Security and Resilience

Frequently Asked Questions

What is CVE-2026-44615?

Apache Zeppelin's FileSystemNotebookRepo fails to confine note and folder rename/move operations to the configured notebook directory, letting an already-authenticated user with note-rename or folder-operation permission supply traversal segments ('../') to move, write, or delete files outside the notebook root using the server's own filesystem or Hadoop identity. There is no CVSS score, EPSS data, CISA KEV listing, public exploit, or Nuclei template for this issue, so there is no evidence of active or automated exploitation, and it requires an existing authenticated foothold rather than being remotely exploitable by an anonymous attacker. The real risk sits in shared, multi-tenant Zeppelin deployments used for interactive data science and ML development, where a lower-privileged authenticated user could tamper with other users' notebooks or service-account-reachable files, potentially leading to malicious code landing in paragraphs later executed by higher-privileged interpreters or teammates. Patch to Apache Zeppelin 0.12.1 as soon as feasible; until then, restrict note-rename and folder-operation permissions to trusted/admin roles and audit the FileSystemNotebookRepo storage path for files or directories that have landed outside the configured notebook directory.

Is CVE-2026-44615 actively exploited?

No confirmed active exploitation of CVE-2026-44615 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-44615?

Upgrade to Apache Zeppelin 0.12.1, which fixes the path confinement bug. If immediate patching isn't possible, restrict the permission to rename notes/folders or perform folder operations to trusted administrators only, and review Zeppelin's authorization configuration (shiro.ini / notebook authorization settings) for over-broad grants. Audit the configured notebook directory and its parent paths for files or subdirectories that don't belong there, which would indicate prior exploitation. Add monitoring/logging around note and folder rename API calls for path segments containing '../' or absolute paths, and review the server's filesystem/Hadoop service account permissions to ensure it has no more filesystem access than the notebook directory requires (principle of least privilege for the service identity itself).

What systems are affected by CVE-2026-44615?

This vulnerability affects the following AI/ML architecture patterns: notebook-based ML development, collaborative data science platforms, training/ETL pipelines orchestrated via notebooks.

What is the CVSS score for CVE-2026-44615?

CVE-2026-44615 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.58%.

What is the AI security impact?

Affected AI Architectures

notebook-based ML developmentcollaborative data science platformstraining/ETL pipelines orchestrated via notebooks

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.1

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using the server's filesystem or Hadoop identity without ensuring that the result remained under the configured notebook directory. This could allow notebook files or directories to be moved, written, or deleted outside the notebook root. This issue affects Apache Zeppelin versions 0.9.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Exploitation Scenario

A data scientist or analyst with legitimate but limited access to a shared Zeppelin instance — enough to rename their own notes or manipulate folders — issues a rename/move request where the target note or folder path contains traversal sequences like '../../../etc/cron.d/malicious'. Because Zeppelin composes the destination path using the server's filesystem or Hadoop identity without validating that the result stays under the configured notebook root, the file lands outside the intended sandbox. The attacker uses this to overwrite a colleague's notebook with a paragraph that exfiltrates credentials or data when the interpreter next executes it, or to delete/tamper with files the service account can reach, causing data loss or disrupting the shared ML development environment.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.