CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation

Reported by oss-security

Summary by Cyber Security News3 Nov 2026, 20:59 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/484

Posted by Andor Molnar on Nov 03 Severity: moderate CVSS 4.0: 6.0 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Affected versions: - Apache ZooKeeper 3.9.0 through 3.9.6 - Apache ZooKeeper 3.8.0 through 3.8.7 Description: Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw

Ghostunnel: Open-source TLS proxy with mutual authentication

Rails security releases: 8.0.5.2 and 8.1.4.1

Fixed Detectors, Moving Code: How Well Do Static Security Analyzers Hold Up over a Decade of C/C++ Evolution?

When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation

CGI versions before 5.00 for Perl (20 CVEs)