Zookeeper
Monthly
Authorization bypass in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets remote attackers delete empty persistent, container, and TTL znodes by sending a raw deleteContainer opcode (20) to the client port - 2181 by default - without any credentials or ACL grant, because that code path skips both the session check and the DELETE ACL check enforced by the normal delete path. The official client exposes no API for this internal-only opcode, so exploitation requires hand-crafting the ZooKeeper wire protocol, and non-empty nodes cannot be removed directly. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the impact is integrity-only, and no public exploit code has been identified at time of analysis with EPSS at 0.24% (16th percentile); practical risk is governed mainly by whether port 2181 is reachable from outside the trusted application or ensemble network.
Improper certificate hostname validation in Apache ZooKeeper's quorum TLS path allows a CA-trusted peer certificate whose SAN does not match the connected host to be accepted when FIPS mode and quorum hostname verification are enabled, letting the holder of such a certificate join quorum traffic, participate in leader election, and enter replication flows. Only deployments that simultaneously set sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true and ssl.quorum.clientHostnameVerification=true on affected releases (3.8.0 through 3.8.6 and 3.9.0 through 3.9.5) are exposed; plain TLS and non-quorum-TLS ensembles are unaffected. Exploitation additionally requires a certificate chaining to a CA already trusted by the quorum truststore, so the practical barrier is high; no public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile). Unauthenticated remote attackers are in scope per the CVSS vector (PR:N), though the certificate precondition makes real-world abuse a targeted rather than opportunistic scenario.
Unauthenticated remote clients can discover the names of ACL-restricted znodes in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 by abusing the SetWatches/SetWatches2 reconnect replay path, which replays watch events without the ACL check that a prior fix (CVE-2024-23944 / ZOOKEEPER-4799) added to WatchManager.triggerWatch(). An attacker registers exists-watches on not-yet-existing paths, reconnects after a privileged process creates those paths under a restrictive ACL, and learns the path names through the replayed events - only the path is exposed, never the znode data, though path names can themselves encode sensitive identifiers such as usernames or login IDs. Exploitation is probabilistic, requiring correct guessing of target path names and favorable reconnect timing, and the independent assessment rates confidentiality impact as Low (vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) rather than the published 7.5; EPSS is 0.20% (10th percentile), and no public exploit has been identified at time of analysis.
Apache ZooKeeper 3.8.5 and 3.9.4 improperly log sensitive client configuration data at INFO level, allowing unauthenticated remote attackers to extract credentials and other confidential information from application logfiles. The vulnerability affects all platforms and requires no user interaction or special privileges to exploit. No patch is currently available, leaving vulnerable deployments exposed until upgrades to versions 3.8.6 or 3.9.5 are deployed.
Hostname verification bypass in Apache ZooKeeper's ZKTrustManager allows attackers with a valid certificate trusted by the server to impersonate ZooKeeper nodes by exploiting fallback to reverse DNS validation when IP SAN checks fail. An attacker controlling or spoofing PTR records can intercept and forge communications between ZooKeeper servers and clients, compromising confidentiality and integrity of the cluster. No patch is currently available; mitigation requires upgrading to ZooKeeper 3.8.6 or 3.9.5 or disabling reverse DNS lookup via configuration.
Log forgery in Apache ZooKeeper 3.8.0–3.8.6 and 3.9.0–3.9.5 allows a remote client to inject arbitrary fake entries into the server's operational log by sending an add_auth("ensemble", ...) request whose ensemble name contains embedded newline characters. EnsembleAuthenticationProvider.handleAuthentication() writes the raw, unsanitized name through LOG.warn(), and because SLF4J's {} placeholder does not escape newlines, the attacker controls timestamp, level, class name and message text of the resulting lines. Apache rates the issue moderate and directs users to 3.8.7 or 3.9.6.
Audit log injection in Apache ZooKeeper 3.9.0–3.9.5 and 3.8.0–3.8.6 allows attackers to forge entries in zookeeper_audit.log when audit logging is enabled. An unauthenticated attacker can embed tab characters in a digest authentication username to inject arbitrary tab-separated key=value fields, and a client permitted to call setACL can embed tabs in a digest ACL id to make a successful setAcl event appear to record forged operations such as operation=delete and znode=/forged. The vulnerability corrupts forensic evidence and can defeat SIEM alerting, but does not permit direct modification of ZooKeeper data; no public exploit code or CISA KEV listing was identified at time of analysis, and vendor-released fixes exist in 3.9.6 and 3.8.7.
Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions.9.0 before 3.9.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 17.4%.
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Authorization bypass in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets remote attackers delete empty persistent, container, and TTL znodes by sending a raw deleteContainer opcode (20) to the client port - 2181 by default - without any credentials or ACL grant, because that code path skips both the session check and the DELETE ACL check enforced by the normal delete path. The official client exposes no API for this internal-only opcode, so exploitation requires hand-crafting the ZooKeeper wire protocol, and non-empty nodes cannot be removed directly. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the impact is integrity-only, and no public exploit code has been identified at time of analysis with EPSS at 0.24% (16th percentile); practical risk is governed mainly by whether port 2181 is reachable from outside the trusted application or ensemble network.
Improper certificate hostname validation in Apache ZooKeeper's quorum TLS path allows a CA-trusted peer certificate whose SAN does not match the connected host to be accepted when FIPS mode and quorum hostname verification are enabled, letting the holder of such a certificate join quorum traffic, participate in leader election, and enter replication flows. Only deployments that simultaneously set sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true and ssl.quorum.clientHostnameVerification=true on affected releases (3.8.0 through 3.8.6 and 3.9.0 through 3.9.5) are exposed; plain TLS and non-quorum-TLS ensembles are unaffected. Exploitation additionally requires a certificate chaining to a CA already trusted by the quorum truststore, so the practical barrier is high; no public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile). Unauthenticated remote attackers are in scope per the CVSS vector (PR:N), though the certificate precondition makes real-world abuse a targeted rather than opportunistic scenario.
Unauthenticated remote clients can discover the names of ACL-restricted znodes in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 by abusing the SetWatches/SetWatches2 reconnect replay path, which replays watch events without the ACL check that a prior fix (CVE-2024-23944 / ZOOKEEPER-4799) added to WatchManager.triggerWatch(). An attacker registers exists-watches on not-yet-existing paths, reconnects after a privileged process creates those paths under a restrictive ACL, and learns the path names through the replayed events - only the path is exposed, never the znode data, though path names can themselves encode sensitive identifiers such as usernames or login IDs. Exploitation is probabilistic, requiring correct guessing of target path names and favorable reconnect timing, and the independent assessment rates confidentiality impact as Low (vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) rather than the published 7.5; EPSS is 0.20% (10th percentile), and no public exploit has been identified at time of analysis.
Apache ZooKeeper 3.8.5 and 3.9.4 improperly log sensitive client configuration data at INFO level, allowing unauthenticated remote attackers to extract credentials and other confidential information from application logfiles. The vulnerability affects all platforms and requires no user interaction or special privileges to exploit. No patch is currently available, leaving vulnerable deployments exposed until upgrades to versions 3.8.6 or 3.9.5 are deployed.
Hostname verification bypass in Apache ZooKeeper's ZKTrustManager allows attackers with a valid certificate trusted by the server to impersonate ZooKeeper nodes by exploiting fallback to reverse DNS validation when IP SAN checks fail. An attacker controlling or spoofing PTR records can intercept and forge communications between ZooKeeper servers and clients, compromising confidentiality and integrity of the cluster. No patch is currently available; mitigation requires upgrading to ZooKeeper 3.8.6 or 3.9.5 or disabling reverse DNS lookup via configuration.
Log forgery in Apache ZooKeeper 3.8.0–3.8.6 and 3.9.0–3.9.5 allows a remote client to inject arbitrary fake entries into the server's operational log by sending an add_auth("ensemble", ...) request whose ensemble name contains embedded newline characters. EnsembleAuthenticationProvider.handleAuthentication() writes the raw, unsanitized name through LOG.warn(), and because SLF4J's {} placeholder does not escape newlines, the attacker controls timestamp, level, class name and message text of the resulting lines. Apache rates the issue moderate and directs users to 3.8.7 or 3.9.6.
Audit log injection in Apache ZooKeeper 3.9.0–3.9.5 and 3.8.0–3.8.6 allows attackers to forge entries in zookeeper_audit.log when audit logging is enabled. An unauthenticated attacker can embed tab characters in a digest authentication username to inject arbitrary tab-separated key=value fields, and a client permitted to call setACL can embed tabs in a digest ACL id to make a successful setAcl event appear to record forged operations such as operation=delete and znode=/forged. The vulnerability corrupts forensic evidence and can defeat SIEM alerting, but does not permit direct modification of ZooKeeper data; no public exploit code or CISA KEV listing was identified at time of analysis, and vendor-released fixes exist in 3.9.6 and 3.8.7.
Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions.9.0 before 3.9.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. Rated medium severity (CVSS 5.3), this vulnerability is low attack complexity. No vendor patch available.
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 17.4%.
Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.