Major Description
I was playing with Zeppelin. I found JdbcRealm implementation could result in SQL injection. I am not sure about the exploitability. Since an untrusted user need to modify the config.
vulnerable code
userquery = String.format("SELECT %s FROM %s", username, tablename);