CVE-2018-8012
Missing Authorization in Apache ZooKeeper
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
CVE-2018-8012- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
CVE-2018-8012- Updated
- 2026-11-02
EUVDEUVD-2022-3562 No score
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
EUVD-2022-3562- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ccqf-c5hq-77mp
Missing Authorization in Apache ZooKeeper
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
GHSA-ccqf-c5hq-77mp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
CVE-2018-8012- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-8012
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
DEBIAN-CVE-2018-8012- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-ccqf-c5hq-77mp
Missing Authorization in Apache ZooKeeper
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
GHSA-ccqf-c5hq-77mp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-8012
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
- Record
UBUNTU-CVE-2018-8012- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUSN-4789-1 No score
zookeeper vulnerabilities
It was discovered that Apache ZooKeeper incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. (CVE-2016-5017)
It was discovered that Apache ZooKeeper incorrectly implemented "wchp/wchc" commands. An attacker could possibly use this issue to cause a denial of service. (CVE-2017-5637)
It was discovered that Apache Zookeeper incorrectly handled clusters. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-8012)
- Record
USN-4789-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.zookeeper:zookeeperMaven |
through 3.4.9 | 3.4.10 |
org.apache.zookeeper:zookeeperMaven |
3.5.0-alpha to 3.5.3-beta | 3.5.4-beta |
zookeeperDebian:12 |
before 3.4.10-2 | 3.4.10-2 |
zookeeperDebian:13 |
before 3.4.10-2 | 3.4.10-2 |
zookeeperDebian:14 |
before 3.4.10-2 | 3.4.10-2 |
zookeeperDebian:8 |
before 3.4.9-3+deb8u1, plus listed versions 3.4.5+dfsg-23.4.5+dfsg-2+deb8u13.4.5+dfsg-2+deb8u23.4.6-13.4.6-2 Show 12 moreShow less3.4.6-33.4.6-43.4.6-53.4.6-63.4.6-73.4.6-83.4.7-13.4.8-13.4.8-23.4.9-13.4.9-23.4.9-3 |
3.4.9-3+deb8u1 |
zookeeperDebian:9 |
before 3.4.9-3+deb9u1, plus listed versions 3.4.9-3 |
3.4.9-3+deb9u1 |
org.apache.zookeeper:zookeeperMaven |
before 3.4.10, plus listed versions 3.3.03.3.13.3.23.3.33.3.4 Show 12 moreShow less3.3.53.3.63.4.03.4.13.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9 |
3.4.10 |
org.apache.zookeeper:zookeeperMaven |
3.5.0-alpha up to 3.5.4-beta, plus listed versions 3.5.1-alpha3.5.2-alpha3.5.3-beta |
3.5.4-beta |
zookeeperUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.4.5+dfsg-13.4.5+dfsg-1ubuntu0.1~esm13.4.5+dfsg-1ubuntu0.1~esm3 |
None known |
zookeeperUbuntu:Pro:16.04:LTS |
before 3.4.8-1ubuntu0.1~esm1, plus listed versions 3.4.6-83.4.7-13.4.8-1 |
3.4.8-1ubuntu0.1~esm1 |
zookeeperUbuntu:Pro:14.04:LTS |
before 3.4.5+dfsg-1ubuntu0.1~esm1, plus listed versions 3.4.5+dfsg-1 |
3.4.5+dfsg-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-8012 is a high vulnerability (CVSS 7.5) in Apache Zookeeper, published May 21, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.42%, the 94th percentile. Fixed in org.apache.zookeeper:zookeeper 3.4.10.
References
debian.org/security/2018/dsa-4214
securitytracker.com/id/1040948
securityfocus.com/bid/104253
lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
Show 26 moreShow less
oracle.com/security-alerts/cpujul2020.html
nvd.nist.gov/vuln/detail/CVE-2018-8012
github.com/advisories/GHSA-ccqf-c5hq-77mp
security-tracker.debian.org/tracker/CVE-2018-8012
ubuntu.com/security/CVE-2018-8012
issues.apache.org/jira/browse/ZOOKEEPER-1045
openwall.com/lists/oss-security/2018/05/21/6
cwiki.apache.org/confluence/display/ZOOKEEPER/Server-Server+mutual+authentication
cve.org/CVERecord?id=CVE-2018-8012