CVE-2026-100235Medium· 6.0▾ SunlitIncorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outst…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper.
When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect. A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation — for example, committing writes or deletes after losing write access, or re-granting itself full permissions, which persistently defeats the revocation. In deployments transitioning from the default OPEN_ACL_UNSAFE ACL to a restrictive ACL, any unauthenticated client can exploit this during the transition.
This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
org.apache.zookeeper:zookeeper >= 3.9.0 <= 3.9.6org.apache.zookeeper:zookeeper >= 3.8.0 <= 3.8.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100252High· 8.6Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
CVE-2026-100300High· 8.7Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
CVE-2026-115448High· 8.7Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
CVE-2026-100302High· 7.1Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
CVE-2026-20908Medium· 5.3Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service
CVE-2026-29518High· 7.0Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with s…