High severity · published Sep 16, 2026
CVE-2026-59969
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AZ
Apache ZooKeeper · Apache Software Foundation
3.9.0 through 3.9.5; 3.8.0 through 3.8.6 · source: vendor
ZO
Zookeeper · Apache
3.8.0 before 3.8.7; 3.9.0 before 3.9.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59969
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59969
Mailing List
https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/15/4
More from Apache ZooKeeper
7.5
CVE-2026-79993
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
7.5
CVE-2026-59739
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
7.5
CVE-2026-24308
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
7.4
CVE-2026-24281
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
5.3
CVE-2026-84501
Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider