Skip to content
NewA calmer, faster ZeroHour
Vulnerability4 · 2 reads

CVE-2026-59969

Quorum TLS Hostname Verification Bypass in Apache ZooKeeper FIPS Mode

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-59969 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Apache ZooKeeper fails to enforce peer certificate hostname verification on its quorum TLS path in FIPS-mode deployments, meaning a CA-trusted certificate whose Subject Alternative Name does not match the connecting host is still accepted (CWE-297). The flaw is only triggered when sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are all enabled. An attacker holding a malicious or misissued certificate trusted by the cluster's CA can join quorum traffic, participate in leader election, and enter replication flows, potentially gaining influence over cluster consensus or access to replicated data. Only operators running FIPS-mode ZooKeeper clusters with quorum TLS enabled are affected. No public proof-of-concept, KEV listing, or CVSS score exists yet, and no exploitation is known.

What to do: Upgrade to Apache ZooKeeper 3.8.7 or 3.9.6, which fix the issue. Until patched, verify whether sslQuorum and zookeeper.fips-mode are enabled in your configuration, ensure all quorum certificates carry correct SANs, and restrict quorum peer ports (e.g., 2888/3888) to trusted cluster members at the network layer to block untrusted peers from joining.

ProductAffected
Apache ZooKeeperVersions earlier than 3.8.7 (3.8 line) and earlier than 3.9.6 (3.9 line), when quorum TLS is enabled (sslQuorum=true) with zookeeper.fips-mode=true and quorum h
Estimated exposure
nichelikely only thousands of clusters worldwide (FIPS-mode quorum TLS is a narrow subset of ZooKeeper deployments) — ZooKeeper is widely deployed (often alongside Kafka, Hadoop, and HBase), but the vulnerability requires the uncommon combination of FIPS mode plus quorum TLS, concentrated in government and regulated-industry clusters, so only a small…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

Vendors
apache
Products
zookeeper
Weakness
CWE-297
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story