CVE-2026-59969
published 2026-09-16CVE-2026-59969: Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.33%
24.8th percentile
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zookeeper | — | — |
| apache | zookeeper | >= 3.8.0 < 3.8.7 | 3.8.7 |
| apache | zookeeper | >= 3.9.0 < 3.9.6 | 3.9.6 |
| apache_software_foundation | apache_zookeeper | 3.8.0 – 3.8.6 | — |
| apache_software_foundation | apache_zookeeper | 3.9.0 – 3.9.5 | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| rhoai | odh-modelmesh-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache ZooKeeper certificate validation
vuldb·2026-09-21·CVSS 7.5
CVE-2026-59969 [HIGH] Apache ZooKeeper certificate validation
A vulnerability identified as problematic has been detected in Apache ZooKeeper. This issue affects some unknown processing. The manipulation leads to improper certificate validation.
This vulnerability is documented as CVE-2026-59969. The attack can be initiated remotely. There is not any exploit available.
GHSA
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.
ghsa_unreviewed·2026-09-16
CVE-2026-59969 [HIGH] CWE-297 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Red Hat
zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise
vendor_redhat·2026-09-16·CVSS 7.5
CVE-2026-59969 [HIGH] CWE-295 zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise
zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
A flaw was found in Apache ZooKeeper. When operating in FIPS (Federal Information Processing Standards) mode with specifi
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59969 golang-github-zookeeper-zk: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [epel-all]
bugzilla·2026-09-28·CVSS 7.5
CVE-2026-59969 [HIGH] CVE-2026-59969 golang-github-zookeeper-zk: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [epel-all]
CVE-2026-59969 golang-github-zookeeper-zk: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic
Bugzilla
CVE-2026-59969 golang-github-zookeeper-zk: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [fedora-all]
bugzilla·2026-09-28·CVSS 7.5
CVE-2026-59969 [HIGH] CVE-2026-59969 golang-github-zookeeper-zk: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [fedora-all]
CVE-2026-59969 golang-github-zookeeper-zk: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traff
Bugzilla
CVE-2026-59969 golang-github-samuel-zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [fedora-all]
bugzilla·2026-09-28·CVSS 7.5
CVE-2026-59969 [HIGH] CVE-2026-59969 golang-github-samuel-zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [fedora-all]
CVE-2026-59969 golang-github-samuel-zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum t
Bugzilla
CVE-2026-59969 zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise
bugzilla·2026-09-16·CVSS 7.5
CVE-2026-59969 [HIGH] CVE-2026-59969 zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise
CVE-2026-59969 zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
2026-09-16
Published