Missing authorization in Apache ZooKeeper
Priority MEDIUM 44CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Why it matters now
EPSS 0.08415 95th percentileScored 2026-11-07
Fix Partial org.apache.zookeeper:zookeeper (Maven): 3.4.10, 3.5.4-betaRed Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ZooKeeper | Apache ZooKeeper prior to 3.4.10, Apache ZooKeeper 3.5.0-alpha through 3.5.3-beta | — | No fix listed | CNA |
| — | org.apache.zookeeper:zookeeper (Maven) | before 3.4.10 | 3.4.10 | Patch available | GHSA-ccqf-c5hq-77mp |
| — | org.apache.zookeeper:zookeeper (Maven) | 3.5.0-alpha to before 3.5.4-beta | 3.5.4-beta | Patch available | GHSA-ccqf-c5hq-77mp |
- Apache ZooKeeper VendorApache Affected Apache ZooKeeper prior to 3.4.10, Apache ZooKeeper 3.5.0-alpha through 3.5.3-beta Fixed in — No fix listed CNA
- org.apache.zookeeper:zookeeper (Maven) Vendor— Affected before 3.4.10 Fixed in 3.4.10 Patch available GHSA-ccqf-c5hq-77mp
- org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.5.0-alpha to before 3.5.4-beta Fixed in 3.5.4-beta Patch available GHSA-ccqf-c5hq-77mp
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* | before 3.4.10; 3.5.0 – 3.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:* | 3.5.0 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:* | 3.5.3 beta | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:* | before 19.1.0.0.1 | Vulnerable | Oracle |
- cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions before 3.4.10; 3.5.0 – 3.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:* Versions 3.5.0 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:* Versions 3.5.3 beta Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:* Versions before 19.1.0.0.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-ccqf-c5hq-77mp org.apache.zookeeper:zookeeper (Maven) Fixed in 3.4.10 Advisory →
- Fix · GHSA-ccqf-c5hq-77mp org.apache.zookeeper:zookeeper (Maven) Fixed in 3.5.4-beta Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
Not affected: 8 products
- Red Hat BPM Suite 6
- Red Hat Fuse 7
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Fuse Integration Service 2
- Red Hat JBoss Fuse Service Works 6
- Red Hat OpenShift Application Runtimes
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8012
- 2026-10-03 Alias added: GHSA-ccqf-c5hq-77mp
- 2026-10-21 EPSS moved to the 95th–99th percentile
- 2026-10-25 EPSS moved to the 90th–95th percentile
- 2026-10-28 EPSS moved to the 95th–99th percentile
- 2026-10-30 EPSS moved to the 90th–95th percentile
- 2026-11-04 EPSS moved to the 95th–99th percentile
References
Other 16
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html
- https://lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393%40%3Cdev.zookeeper.apache.org%3E
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 opened a new pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 commented on pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012
- [jackrabbit-oak-commits] 20210720 [jackrabbit-oak] branch trunk updated: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 (#326)
- [jackrabbit-dev] 20210720 [GitHub] [jackrabbit-oak] nit0906 merged pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r73daf1fc5d85677d9a854707e1908d14e174b7bbb0c603709c0ab33f@%3Coak-commits.jackrabbit.apache.org%3E
- https://lists.apache.org/thread.html/r8f0d920805af93033c488af89104e2d682662bacfb8406db865d5e14@%3Cdev.jackrabbit.apache.org%3E
- https://lists.apache.org/thread.html/rc5bc4ddb0deabf8cfb69378cecee56fcdc76929bea9e6373cb863870@%3Cdev.jackrabbit.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/re3a4048e9515d4afea416df907a612ed384a16c57cf99e97ee4a12f2@%3Cdev.jackrabbit.apache.org%3E
More Apache Zookeeper vulnerabilities
- TI-2017-03638 Missing authentication in Apache ZooKeeper CVSS 3.0HIGH 7.5
- TI-2023-24043 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication CVSS 3.1CRITICAL 9.1
- TI-2021-04395 Possible request smuggling in HTTP/2 due missing validation CVSS 3.1MEDIUM 5.9
- TI-2024-34425 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server CVSS 3.1CRITICAL 9.1
- TI-2016-04336 Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before… CVSS 3.0HIGH 8.1
- TI-2026-55327 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5
Sources
- CVE-2018-8012 · CVE Program
- CVE-2018-8012 · NVD
- FIRST EPSS
- GHSA-ccqf-c5hq-77mp · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8012 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences