CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 fail to enforce peer hostname verification for quorum TLS when FIPS mode is enabled with sslQuorum, zookeeper.fips-mode, and hostname verification settings turned on. The flaw is rated important and could allow an attacker to impersonate a quorum peer via certificate host mismatch. Users should upgrade to fixed versions.
- Affects ZooKeeper 3.8.0-3.8.6 and 3.9.0-3.9.5
- Quorum TLS hostname verification bypassed only in FIPS-mode configurations
- Rated important; could enable quorum peer impersonation
- No exploitation observed
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59969 | Quorum TLS Hostname Verification Bypass in Apache ZooKeeper FIPS Mode | 7.5 | — |
From the original article
Posted by Andor Molnar on Sep 15 Severity: important Affected versions: - Apache ZooKeeper (org. apache. zookeeper:zookeeper) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.