CVE-2026-59969

Apache ZooKeeper contains a vulnerability where quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When specific settings are enabled—namely sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true...

EUVD-2026-80331

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CVE-2026-59969 Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CVE-2026-59969

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739

Apache ZooKeeper is vulnerable to information disclosure due to a missing ACL check in the SetWatches reconnect replay handler. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths and then reconnecting after those paths are created with restricted ACL...

CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

EUVD-2026-80330

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

PT-2026-93418

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.8.0 through 3.8.6 Apache ZooKeeper versions 3.9.0 through 3.9.5 Description An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add auth"ensemble", ... reque...

CVE-2026-59969: Improper Validation of Certificate with Host Mismatch

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CVE-2026-79993: Missing Authorization

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-59739: Missing Authorization

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

PT-2026-93406

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.9.6 Apache ZooKeeper versions prior to 3.8.7 Description An information disclosure issue exists due to a missing Access Control List ACL check during the SetWatches reconnect replay. An attacker can discove...

CVE-2026-84501: Improper Output Neutralization for Logs

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

CVE-2026-84439: Improper Output Neutralization for Logs

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

PT-2026-93407

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.8.7 Apache ZooKeeper versions prior to 3.9.6 Description Quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true,...

PT-2026-93415

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.9.0 through 3.9.5 Apache ZooKeeper versions 3.8.0 through 3.8.6 Description An authorization bypass exists where the deleteContainer opcode 0x14/20 is processed without verifying the caller's Access Control List ACL...