CVE-2026-59969
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
CVE-2026-59969- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
EUVDEUVD-2026-80331
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
EUVD-2026-80331- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4pv3-cr63-m4ph
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments....
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
GHSA-4pv3-cr63-m4ph- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
NVD
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
CVE-2026-59969- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSV
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
CVE-2026-59969- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-59969
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
DEBIAN-CVE-2026-59969- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHLW-2026-19f4511248f79d69
Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015
Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.
CVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling
CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.
- Record
RHLW-2026-19f4511248f79d69- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-10
OSVUBUNTU-CVE-2026-59969
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
UBUNTU-CVE-2026-59969- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-zookeeper-2026-59969No score
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
- Record
BIT-zookeeper-2026-59969- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zookeeperBitnami | 3.8.0 up to 3.8.7, 3.9.0 up to 3.9.6 | 3.8.73.9.6 |
zookeeperDebian:12 | All versions, plus listed versions 3.8.0-113.8.0-11+deb12u13.8.0-11+deb12u23.9.1-13.9.2-1 Show 8 moreShow less3.9.2-23.9.3-13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 | None known |
zookeeperDebian:13 | All versions, plus listed versions 3.9.3-13.9.3-1+deb13u13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 | None known |
zookeeperDebian:14 | before 3.9.6-1, plus listed versions 3.9.3-13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-2 | 3.9.6-1 |
org.apache.zookeeper:zookeeperRed Hat Lightwell:Maven From an advisory covering 7 CVEs | before 3.8.3.rhlw-00015, plus listed versions 3.3.03.3.13.3.23.3.33.3.4 Show 40 moreShow less3.3.53.3.63.4.03.4.13.4.103.4.113.4.123.4.133.4.143.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.0-alpha3.5.1-alpha3.5.103.5.2-alpha3.5.3-beta3.5.4-beta3.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.8.03.8.13.8.23.8.3 | 3.8.3.rhlw-00015 |
zookeeperUbuntu:Pro:14.04:LTS | All versions, plus listed versions 3.4.5+dfsg-13.4.5+dfsg-1ubuntu0.1~esm13.4.5+dfsg-1ubuntu0.1~esm3 | None known |
zookeeperUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.4.6-83.4.7-13.4.8-13.4.8-1ubuntu0.1~esm13.4.8-1ubuntu0.1~esm2 | None known |
zookeeperUbuntu:Pro:18.04:LTS | All versions, plus listed versions 3.4.10-23.4.10-33.4.13-33.4.13-3ubuntu0.1~esm1 | None known |
zookeeperUbuntu:20.04:LTS | All versions, plus listed versions 3.4.13-13.4.13-33.4.13-3build13.4.13-43.4.13-53.4.13-5build13.4.13-5ubuntu0.1 | None known |
zookeeperUbuntu:22.04:LTS | All versions, plus listed versions 3.4.13-5ubuntu43.4.13-6ubuntu23.4.13-6ubuntu33.4.13-6ubuntu43.4.13-6ubuntu4.1 | None known |
zookeeperUbuntu:24.04:LTS | All versions, plus listed versions 3.8.0-113.9.1-13.9.1-1build13.9.1-1build2 | None known |
zookeeperUbuntu:26.10 | All versions, plus listed versions 3.9.5-13.9.5-2 | None known |
zookeeperUbuntu:26.04:LTS | All versions, plus listed versions 3.9.3-1build23.9.3-1build33.9.4-13.9.5-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59969 is a high vulnerability (CVSS 7.5) in Apache Zookeeper, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in zookeeper 3.8.7.
References
lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss
openwall.com/lists/oss-security/2026/09/15/4
nvd.nist.gov/vuln/detail/CVE-2026-59969
github.com/advisories/GHSA-4pv3-cr63-m4ph
repo.maven.apache.org/maven2
Show 30 moreShow less
security-tracker.debian.org/tracker/CVE-2026-59969
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json
access.redhat.com/errata/RHSA-2026:10184
ubuntu.com/security/CVE-2026-59969
cve.org/CVERecord?id=CVE-2026-59969