Apache ZooKeeper ACL enforcement bypass allows unauthorized operations
Original title: CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
TOCTOU race condition in setACL request handling allows unauthorized operations to commit after an ACL revocation in versions 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7.
Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the ACL cache until after the request is processed. This allows an attacker to bypass ACL enforcement and perform unauthorized operations to commit after an ACL revocation.
- Affects Apache ZooKeeper 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7
- TOCTOU race condition in setACL request handling
- Allows unauthorized operations to commit after ACL revocation
- CVSS 4.0 score of 6.0 (medium)
Impact: unauthorized operations to commit after an ACL revocation
| Product | Affected |
|---|---|
| Apache ZooKeeper | 3.9.0 through 3.9.6, 3.8.0 through 3.8.7 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100235 | — | — | — |
From the original article
Posted by Andor Molnar on Nov 03 Severity: moderate CVSS 4. 0: 6. 0 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.