Executive brief
Apache ZooKeeper is a distributed coordination service used in many enterprise systems. When running in FIPS-mode with quorum TLS enabled and hostname verification configured, the system fails to properly validate peer certificate Subject Alternative Names (SANs), allowing an attacker with a CA-trusted certificate to impersonate legitimate cluster members, participate in leader election, and manipulate replication flows.
Technical details
This vulnerability is a certificate validation bypass in ZooKeeper's Java SSLSocket implementation for quorum communication. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are all enabled, the code fails to properly enforce SAN matching during peer authentication. An attacker can present a certificate issued by a trusted CA that lacks SAN matching the target hostname and still be accepted into the cluster. Attack vectors include network position allowing connection to quorum members. The vulnerability enables unauthorized cluster membership, leader election tampering, and replication stream injection. Fixes are available in versions 3.8.7 and 3.9.6.
Affected products
- Apache ZooKeeper before 3.8.7, 3.9.x before 3.9.6
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patches available in ZooKeeper 3.8.7 and 3.9.6