TI-2025-36215 Aliases CVE-2025-58457 GHSA-2hmj-97jw-28jh

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

LOW 20CWE-280Published 2025-09-24 · Updated 2025-11-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00338 27th percentileScored 2026-11-07

Fix Partial Apache ZooKeeper (Apache Software Foundation): 3.9.4org.apache.zookeeper:zookeeper (Maven): 3.9.4Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache ZooKeeper	3.9.0 to before 3.9.4	3.9.4	Patch available	CNA
—	org.apache.zookeeper:zookeeper (Maven)	3.9.0 to before 3.9.4	3.9.4	Patch available	GHSA-2hmj-97jw-28jh

Apache ZooKeeper VendorApache Affected 3.9.0 to before 3.9.4 Fixed in 3.9.4 Patch available CNA
org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.9.0 to before 3.9.4 Fixed in 3.9.4 Patch available GHSA-2hmj-97jw-28jh

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:zookeeper::::::::	3.9.0 to before 3.9.4	Vulnerable	Apache

cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions 3.9.0 to before 3.9.4 Vulnerable ·Apache

Remediation

Fix · CNA Apache ZooKeeper (Apache Software Foundation) Fixed in 3.9.4
Fix · GHSA-2hmj-97jw-28jh org.apache.zookeeper:zookeeper (Maven) Fixed in 3.9.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
streams for Apache Kafka 2	Affected	No fix yet: Fix deferred
streams for Apache Kafka 3	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-58457
2026-10-03 Alias added: GHSA-2hmj-97jw-28jh

References

Advisory 2

Other 6

TI-2017-03638 Missing authentication in Apache ZooKeeper CVSS 3.0HIGH 7.5
TI-2023-24043 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication CVSS 3.1CRITICAL 9.1
TI-2021-04395 Possible request smuggling in HTTP/2 due missing validation CVSS 3.1MEDIUM 5.9
TI-2024-34425 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server CVSS 3.1CRITICAL 9.1
TI-2016-04336 Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before… CVSS 3.0HIGH 8.1
TI-2018-05789 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences