CLEANSTART-2026-LU86792: Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Q: Which deployments should be prioritized for triage?

Prioritize cleanstart/apache-nifi deployments that use Apache ZooKeeper quorum TLS in FIPS mode. The provided data does not identify affected package versions or indicate whether non-FIPS deployments are affected.

Q: What level of attacker access is indicated by the severity vector?

The vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction. It indicates a high integrity impact, with no stated confidentiality or availability impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the apache-nifi package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.

Affected Software

1 affected componentFixes available

cleanstart/apache-nifi<2.11.0-r3

2.11.0-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.11.0-r3

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-59969

Frequently Asked Questions

Which deployments should be prioritized for triage?

Prioritize cleanstart/apache-nifi deployments that use Apache ZooKeeper quorum TLS in FIPS mode. The provided data does not identify affected package versions or indicate whether non-FIPS deployments are affected.

What level of attacker access is indicated by the severity vector?

The vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction. It indicates a high integrity impact, with no stated confidentiality or availability impact.

CLEANSTART-2026-LU86792: Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for triage?

What level of attacker access is indicated by the severity vector?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for triage?

What level of attacker access is indicated by the severity vector?