CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.8.7 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use ZooKeeper quorum TLS with sslQuorum=true and FIPS mode enabled through zookeeper.fips-mode=true. The vulnerable path also has ssl.quorum.hostnameVerification=true and ssl.quorum.clientHostnameVerification=true enabled.
What does an attacker need to exploit it?
The attacker needs a peer certificate trusted by the configured CA, but whose SAN does not match the host being connected to. Such a malicious or misissued certificate can be accepted by the Java SSLSocket quorum path in the affected configuration.
What could successful exploitation allow?
An accepted unauthorized peer can join quorum traffic, participate in leader election, and enter replication flows.
What versions address the issue?
Upgrade Apache ZooKeeper to version 3.8.7 or 3.9.6.