This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/zeppelin-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new a98aad031 Automatic Site Publish by Buildbot
a98aad031 is described below
commit a98aad031027486b2fe8990bb902faf77e372a4c
Author: buildbot <[email protected]>
AuthorDate: Fri Sep 25 15:52:12 2026 +0000
Automatic Site Publish by Buildbot
---
output/atom.xml | 2 +-
output/rss.xml | 4 ++--
output/security.html | 35 ++++++++++++++++++++++++-----------
3 files changed, 27 insertions(+), 14 deletions(-)
diff --git a/output/atom.xml b/output/atom.xml
index 76c736b86..3b069a89e 100644
--- a/output/atom.xml
+++ b/output/atom.xml
@@ -4,7 +4,7 @@
<title>Apache Zeppelin</title>
<link href="http://zeppelin.apache.org/"; rel="self"/>
<link href="http://zeppelin.apache.org"/>
- <updated>2026-09-23T13:57:43+00:00</updated>
+ <updated>2026-09-25T15:52:02+00:00</updated>
<id>http://zeppelin.apache.org</id>
<author>
<name>The Apache Software Foundation</name>
diff --git a/output/rss.xml b/output/rss.xml
index 4f1fe8e1c..5379f81ef 100644
--- a/output/rss.xml
+++ b/output/rss.xml
@@ -5,8 +5,8 @@
<description>Apache Zeppelin - The Apache Software
Foundation</description>
<link>http://zeppelin.apache.org</link>
<link>http://zeppelin.apache.org</link>
- <lastBuildDate>2026-09-23T13:57:43+00:00</lastBuildDate>
- <pubDate>2026-09-23T13:57:43+00:00</pubDate>
+ <lastBuildDate>2026-09-25T15:52:02+00:00</lastBuildDate>
+ <pubDate>2026-09-25T15:52:02+00:00</pubDate>
<ttl>1800</ttl>
diff --git a/output/security.html b/output/security.html
index 0821a3c8c..42d2c0bb3 100644
--- a/output/security.html
+++ b/output/security.html
@@ -155,6 +155,11 @@ Apache Zeppelin, what measures operators of a Zeppelin
instance will have to
take, and how to report any security issues found in the Zeppelin
software.</p>
+<p>The project's
+<a
href="https://github.com/apache/zeppelin/blob/master/THREAT_MODEL.md";>security
threat model</a>
+defines the security boundaries used when evaluating potential
+vulnerabilities. This page provides deployment guidance for operators.</p>
+
<h2>Code execution on the server</h2>
<p>It is the nature of the Zeppelin software that it allows
@@ -165,11 +170,12 @@ available to trusted users, and the server on which
Zeppelin is
installed does not contain any secrets or have privileges beyond
those the users are trusted with.</p>
-<p>All interpreters should be assumed to be able to access the local
-shell and execute arbitrary commands with the privileges of the user
-running the Zeppelin server. As generic interpreters such as sh, Groovy,
-Java and Python make this especially trivial, we plan to disable the sh
-interpreter by default from version 0.11.1 onward.</p>
+<p>All interpreters should be assumed to be able to access the local shell and
+execute arbitrary commands with the privileges of the interpreter process's
+OS identity. By default, when interpreter user impersonation is disabled,
+interpreter processes run as the same OS user as the Zeppelin server. Generic
+interpreters such as sh, Groovy, Java and Python make this access especially
+direct.</p>
<h3>JDBC Interpreter</h3>
@@ -225,12 +231,19 @@ to other services on the same domain.</p>
<p>If you expose your Zeppelin instance on a network you don't fully trust,
you should configure <a
href="https://zeppelin.apache.org/docs/latest/setup/security/shiro_authentication.html";>Apache
Shiro authentication</a>.</p>
-<p>Non-authenticated users cannot view, store or execute notes, so they
-cannot execute code on the server or on other users' browsers.
-Authenticated users, however, have the same access as described above,
-so even when using authentication it is still important to only give
-trusted users access to Zeppelin. Specifically, users technically
-have access to all notes by other users.</p>
+<p>With Shiro authentication configured, unauthenticated users cannot view,
store
+or execute notes, so they cannot execute code on the server or on other
users'
+browsers. Authenticated users remain subject to each note's
+<a
href="https://zeppelin.apache.org/docs/latest/setup/security/notebook_authorization.html";>configured
owner, reader, writer and runner permissions</a>
+for operations through Zeppelin's UI, REST APIs and WebSocket APIs.</p>
+
+<p>These note permissions are application-level access controls, not an OS or
+interpreter sandbox. A user who is allowed to run interpreter code can access
+resources available to the interpreter's OS identity, potentially including
+notebook storage and other users' data. Only grant run access to users
trusted
+with those resources. When per-user OS identity separation is required, enable
+<a
href="https://zeppelin.apache.org/docs/latest/usage/interpreter/user_impersonation.html";>interpreter
user impersonation</a>
+and apply filesystem and backend access controls.</p>
<h2>Executable verification</h2>
