CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 fail to enforce peer hostname verification for quorum TLS when FIPS mode is enabled with sslQuorum, zookeeper.fips-mode, and hostname verification settings turned on. The flaw is rated important and could allow an attacker to impersonate a quorum peer via certificate host mismatch. Users should upgrade to fixed versions.
- Affects ZooKeeper 3.8.0-3.8.6 and 3.9.0-3.9.5
- Quorum TLS hostname verification bypassed only in FIPS-mode configurations
- Rated important; could enable quorum peer impersonation
- No exploitation observed
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-59969 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Andor Molnar on Sep 15 Severity: important Affected versions: - Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.9.0 through 3.9.5 - Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.8.0 through 3.8.6 Description: Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the...
This source does not provide full text. Read it at seclists.org.