Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)

Add IAVM ID - Multiple Vulnerabilities in Apache ZooKeeper

The version of Apache ZooKeeper listening on the remote host is 3.9.x prior to 3.9.4. It is, therefore, affected by an improper permission check vulnerability:

  - Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot     and restore commands with insufficient permissions. The issue can be mitigated by disabling     both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole     AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not     provide open permissions. (CVE-2025-58457)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore     command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users     are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by     disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole     AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open     permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child     nodes besides notifications from recursive watches.) (CVE-2025-58457)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore
    command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users
    are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by
    disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole
    AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open
    permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child
    nodes besides notifications from recursive watches.) (CVE-2025-58457)

ID	Name	Product	Family	Severity
301977	Apache ZooKeeper 3.9.x < 3.9.4 Improper Permission Check	Nessus	Misc.	medium
266036	Linux Distros Unpatched Vulnerability : CVE-2025-58457	Nessus	Misc.	medium
435422	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-2hmj-97jw-28jh)	Tenable Cloud Security	SCA Checks	medium
435422	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-2hmj-97jw-28jh)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-58457

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium