Authorization Flaw in Apache ZooKeeper Affects Access Control Mechanism

CVE-2026-100235

What is CVE-2026-100235?

The vulnerability in Apache ZooKeeper arises from a race condition during the handling of the setACL request. When a node's Access Control List (ACL) is modified, the pending change does not update the server's record of outstanding changes. This leads to a situation where an unauthorized client retaining permissions can exploit the gap between submission and commitment of the ACL change, allowing them to perform operations that should be restricted. This exploit can include unauthorized write or delete operations, effectively bypassing access controls. Users of versions up to 3.9.6 are urged to upgrade to versions 3.8.8 or 3.9.7 to mitigate the risk associated with this vulnerability.

References