CVE-2018-8012

CVE-2018-8012: vulnerability in Apache ZooKeeper

Published · Updated

Follow this CVE+ Monitor Apache ZooKeeper+ Monitor zookeeper

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 8.4%
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Affected products
Apache Software Foundation · Apache ZooKeeper
Related CVEs — Apache ZooKeeper

In the same product, most dangerous first.

CVE-2017-5637—CVE-2017-5637EPSS 73.1%CVE-2019-0201—CVE-2019-0201EPSS 9.7%CVE-2023-44981CRITICALApache ZooKeeper: Authorization bypass in SASL Quorum Peer AuthenticationEPSS 2.2%CVE-2026-24308MEDIUMApache ZooKeeper: Sensitive information disclosure in client configuration handlingEPSS 1.3%CVE-2024-51504CRITICALApache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerEPSS 0.9%CVE-2026-84501MEDIUMApache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProviderEPSS 0.7%