CVE-2026-59969
Description
A flaw was found in Apache ZooKeeper. When operating in FIPS (Federal Information Processing Standards) mode with specific Transport Layer Security (TLS) settings enabled, ZooKeeper's quorum communication fails to properly verify the hostname of peer certificates. This vulnerability allows a malicious actor, using a specially crafted or misissued certificate, to join the ZooKeeper cluster. Such an actor could then participate in critical operations like leader election and data replication, potentially leading to unauthorized access or disruption of the ZooKeeper service.
Statement
A flaw was found in Apache ZooKeeper when running in FIPS mode. The quorum TLS implementation fails to enforce peer hostname verification, allowing a malicious peer with a CA-trusted certificate (but mismatched SAN) to join quorum traffic, participate in leader election, and access replication flows. This vulnerability only affects deployments with FIPS mode enabled (zookeeper.fips-mode=true) and specific TLS quorum configurations (sslQuorum=true with hostname verification flags). This issue affects Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5.
Mitigation
Update to Apache ZooKeeper 3.8.7, 3.9.6, or later. As a workaround, disable FIPS mode if not required by compliance policies.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Unchanged |
| Confidentiality | High | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
