As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
A time-of-check to time-of-use (TOCTOU) race condition in Apache ZooKeeper's setACL request handling allows authenticated users to perform unauthorized operations on nodes even after their access permissions are revoked. The vulnerability affects ZooKeeper versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6, with a CVSS 4.0 score of 6.0.
Why it matters: ZooKeeper administrators and applications relying on access control lists (ACLs) for node protection must update immediately, as authenticated attackers can bypass permission revocations to modify or access sensitive coordination data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Apache ZooKeeper versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 contain a time-of-check to time-of-use (TOCTOU) race condition in access control list (ACL) handling that allows authenticated users to perform operations after an ACL has been revoked. An attacker with existing credentials can exploit the window between ACL modification and enforcement to commit unauthorized actions.
Why it matters: Organizations running affected ZooKeeper instances must patch immediately, as authenticated attackers can bypass access controls to read or modify protected data despite ACL changes.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Apache ZooKeeper versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 contain a time-of-check to time-of-use (TOCTOU) race condition in ACL handling that allows authenticated users to perform operations after an ACL revocation takes effect. The vulnerability stems from a delay in publishing ACL changes to all nodes in the cluster, creating a window where revoked permissions remain active.
Why it matters: ZooKeeper administrators and users of affected versions face unauthorized data modification risk; patching or upgrading to a fixed version is required to close the race condition window.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Apache ZooKeeper versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 contain a time-of-check to time-of-use (TOCTOU) race condition in ACL handling that allows authenticated users to perform unauthorized operations after an ACL revocation takes effect. The vulnerability stems from a delay in propagating ACL changes to pending requests, creating a window where operations can bypass the updated permissions.
Why it matters: Organizations running affected ZooKeeper versions should upgrade immediately, as authenticated users with revoked permissions can still commit operations, potentially leading to unauthorized data modification or access within distributed systems relying on ZooKeeper for coordination.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Apache ZooKeeper versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 contain a time-of-check to time-of-use race condition in access control list handling that permits authenticated users to perform operations after their permissions have been revoked. The vulnerability arises because ACL changes are not immediately propagated to all pending requests, creating a window where operations can execute with stale authorization state.
Why it matters: Teams running affected ZooKeeper instances with untrusted authenticated users should patch immediately, as attackers with valid credentials can bypass newly applied access restrictions to modify or access protected data.
- Source published
- First seen by Cybersecurity Tracker