Detections
Analytics

Apache ZooKeeper 3.8.x < 3.8.8 / 3.9.x < 3.9.7 Multiple Vulnerabilities

high Nessus Plugin ID 377015

Synopsis

The remote Apache ZooKeeper server is affected by multiple vulnerabilities.

Description

The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.8 or 3.9.x prior to 3.9.7. It is, therefore, affected by multiple vulnerabilities:

 - Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect. A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation.
 (CVE-2026-100235)

 - Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity, and gains the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree. (CVE-2026-100252)

 - Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree - unauthenticated on default deployments, where that subtree is world-writable - to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable.
 (CVE-2026-100300)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Apache ZooKeeper 3.8.8 or 3.9.7 or later.

See Also

https://www.openwall.com/lists/oss-security/2026/11/03/10

https://www.openwall.com/lists/oss-security/2026/11/03/11

https://www.openwall.com/lists/oss-security/2026/11/03/9

Plugin Details

Severity: High

ID: 377015

File Name: apache_zookeeper_3_9_7.nasl

Version: 1.2

Type: Combined

Family: Misc.

Published: 11/6/2026

Updated: 11/6/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.55

CVSS v2

Risk Factor: High

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-100252

CVSS v3

Risk Factor: High

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v4

Risk Factor: High

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-100300

Vulnerability Information

CPE: cpe:/a:apache:zookeeper

Required KB Items: installed_sw/Apache Zookeeper

Patch Publication Date: 11/3/2026

Vulnerability Publication Date: 11/3/2026

Reference Information

CVE: CVE-2026-100235, CVE-2026-100252, CVE-2026-100300

IAVB: 2026-B-0312