As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Apache ZooKeeper fails to properly verify peer hostnames during TLS connections in FIPS-mode deployments, affecting versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. The vulnerability occurs when quorum TLS, FIPS mode, and hostname verification settings are all enabled, allowing potential man-in-the-middle attacks on inter-node communications.
Why it matters: Organizations running ZooKeeper in FIPS-compliant environments with TLS quorum enabled should patch immediately, as this certificate validation bypass undermines the security guarantees that FIPS mode is intended to provide.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 fail to enforce peer hostname verification in FIPS-mode deployments when quorum TLS is configured. The vulnerability affects deployments with multiple security settings enabled simultaneously, allowing potential man-in-the-middle attacks on cluster communication.
Why it matters: Organizations running Apache ZooKeeper in FIPS-compliant environments with TLS-enabled quorum should audit their configurations and apply patches immediately, as the vulnerability undermines hostname verification protections critical to cluster integrity.
- Source published
- First seen by Cybersecurity Tracker