Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-100235

Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper

CVE-2026-100235: Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

CVE-2026-100235 key facts

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
CVSS base score
6 (Apache), 5.3 (Red Hat)
Weakness
CWE-367
Fixed releases
  • Apache: 3.8.8, 3.9.7
Vendor advisories
2 from Apache, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-100235; bulletin-wide values are not repeated here.

Is CVE-2026-100235 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-100235 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-100235?

Upgrade to a fixed release named by the vendor:

  • Apache: 3.8.8, 3.9.7
  • Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue. (Apache)
  • Restrict network exposure by limiting access to ZooKeeper client listener ports (default 2181/TCP) to trusted cluster hosts only, and perform access control modifications during scheduled maintenance windows when client workloads are stopped. To restrict access to ZooKeeper client ports using firewalld: ``` firewall-cmd --permanent --zone=public --remove-port=2181/tcp firewall-cmd --permanent --zone=trusted --add-source= firewall-cmd --reload ``` Warning: Modifying firewall rules and reloading firewalld disrupts existing network connections and may temporarily disconnect active cluster sessions. Ensure all authorized endpoints are configured before reloading. Caveats: Restricting network reachability prevents untrusted external clients from exploiting the race condition during transitions from open access control lists. However, it does not prevent already-authorized clients on trusted subnets from exploiting the timing window during permission revocation unless concurrent client traffic is paused. (Red Hat)

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityMedium6.0

    Medium [CVE-2026-100235] Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper

    CVE-2026-100235Source published Source updated

    Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect. A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation — for example, committing writes or deletes after losing write access, or re-granting itself full permissions, which persistently defeats the…

    Affected products in this advisory
    • Apache ZooKeeper
    Source-reported affected versions
    • 3.9.6
    Source-reported fixed versions
    • 3.8.8
    • 3.9.7
    Mitigation guidance
    • Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-100235] Authorization bypass via race condition in setACL handling

    CVE-2026-100235Source published Source updated

    Authorization bypass via race condition in setACL handling. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-367. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat Fuse 7; Red Hat Offline Knowledge Portal; Red Hat OpenShift AI (RHOAI).

    Related products — impact not confirmed
    • Red Hat AMQ Broker 7
    • Red Hat Fuse 7
    • Red Hat Offline Knowledge Portal
    • Red Hat OpenShift AI (RHOAI)
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Restrict network exposure by limiting access to ZooKeeper client listener ports (default 2181/TCP) to trusted cluster hosts only, and perform access control modifications during scheduled maintenance windows when client workloads are stopped. To restrict access to ZooKeeper client ports using firewalld: ``` firewall-cmd --permanent --zone=public --remove-port=2181/tcp firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet> firewall-cmd --reload ``` Warning: Modifying firewall rules and reloading firewalld disrupts existing network connections and may temporarily disconnect active cluster sessions. Ensure all authorized endpoints are configured before reloading. Caveats: Restricting network reachability prevents untrusted external clients from exploiting the race condition during transitions from open access control lists. However, it does not prevent already-authorized clients on trusted subnets from exploiting the timing window during permission revocation unless concurrent client traffic is paused.
    Full advisory and evidenceOpen source bulletin

More Apache advisories

All Apache advisories

Follow CVE-2026-100235 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Free, no account. Confirm by email; unsubscribe in one click. Choose vendors and severity

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features