CVE-2026-24281mediumCWE-295CWE-350

CVE-2026-24281: medium-severity vulnerability in Apache ZooKeeper

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Published · Updated

Follow this CVE+ Monitor Apache ZooKeeper+ Monitor zookeeper

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.7%
In short

Apache ZooKeeper's hostname verification can be bypassed by attackers who control DNS reverse records (PTR), allowing them to impersonate legitimate servers even with a valid certificate. This matters because it weakens the security of ZooKeeper clusters that rely on certificate-based authentication.

Technical detail

CWE-295 (Improper Certificate Validation) and CWE-350 (Reliance on Reverse DNS Resolution for Security): ZKTrustManager falls back to reverse DNS lookup when Subject Alternative Name (SAN) validation fails, enabling hostname verification bypass. Attackers with PTR record control can present a valid certificate for the reverse-resolved name to impersonate ZooKeeper nodes; however, the certificate must be trusted by the ZKTrustManager, raising the attack complexity.

Summary generated and translated by AI from the official description.
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Apache Software Foundation · Apache ZooKeeper
Related CVEs — Apache ZooKeeper

In the same product, most dangerous first.

CVE-2017-5637—CVE-2017-5637EPSS 73.1%CVE-2019-0201—CVE-2019-0201EPSS 9.7%CVE-2018-8012—CVE-2018-8012EPSS 8.4%CVE-2023-44981CRITICALApache ZooKeeper: Authorization bypass in SASL Quorum Peer AuthenticationEPSS 2.2%CVE-2026-24308MEDIUMApache ZooKeeper: Sensitive information disclosure in client configuration handlingEPSS 1.3%CVE-2024-51504CRITICALApache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerEPSS 0.9%