CVE-2026-100235

Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...