Medium [CVE-2026-100235] Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper
This medium-severity Apache Software Foundation advisory covers CVE-2026-100235 affecting Apache ZooKeeper.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino) publishes the next one.
See Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino)'s last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper.
When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node.
Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect.
A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation — for example, committing writes or deletes after losing write access, or re-granting itself full permissions, which persistently defeats the revocation.
In deployments transitioning from the default OPEN_ACL_UNSAFE ACL to a restrictive ACL, any unauthenticated client can exploit this during the transition.
This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
- 3.9.6
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
- 3.8.8
- 3.9.7
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-100302Nov 4, 2026Apache ZooKeeper denial of service
- CVE-2026-115448Nov 4, 2026Uncontrolled recursion in Apache ZooKeeper
- CVE-2026-100300Nov 4, 2026Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper
- CVE-2026-100252Nov 4, 2026Improper Authorization vulnerability in Apache ZooKeeper
- CVE-2026-84501Sep 16, 2026unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's
- CVE-2026-84439Sep 16, 2026When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.