CVE-2025-58457: Apache ZooKeeper Privilege Escalation Flaw

CVE-2025-58457 Overview

CVE-2025-58457 is an improper permission check vulnerability in Apache ZooKeeper AdminServer. Authorized clients can invoke the snapshot and restore commands without holding the permissions those operations require. The flaw is classified as [CWE-280]: Improper Handling of Insufficient Permissions or Privileges.

The issue affects Apache ZooKeeper versions from 3.9.0 up to, but not including, 3.9.4. Attackers with low-privileged network access to the AdminServer interface can read cluster state via snapshots or trigger restores that should be gated by stricter Access Control Lists (ACLs).

Critical Impact
Authorized but under-privileged clients can execute snapshot and restore operations against ZooKeeper AdminServer, exposing configuration data managed by the coordination service.

Affected Products

Apache ZooKeeper 3.9.0
Apache ZooKeeper 3.9.1, 3.9.2, 3.9.3
Apache ZooKeeper versions prior to 3.9.4

Discovery Timeline

2025-09-24 - CVE-2025-58457 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58457

Vulnerability Analysis

Apache ZooKeeper exposes an AdminServer interface for operational commands such as snapshot and restore. These commands read or write the entire in-memory data tree that ZooKeeper maintains for distributed coordination.

The AdminServer implementation performs authentication but does not correctly validate that the calling identity holds sufficient ACL permissions on the root znode before executing snapshot or restore requests. Any authenticated client with network access to the AdminServer can therefore invoke these commands, bypassing the recursive permission model that operators expect.

Exploitation results in confidentiality loss because snapshots contain the full contents of znodes managed by the ensemble. ZooKeeper is commonly used to store service discovery data, configuration flags, and coordination state for platforms such as Kafka, HBase, and Solr.

Root Cause

The root cause is a missing or incomplete authorization check in the AdminServer command handlers. ZooKeeper ACLs are non-recursive, so relying on child-node ACLs does not restrict operations that act on the tree as a whole. The snapshot and restore commands act on the entire data tree but were not gated against an appropriately restrictive root ACL.

Attack Vector

An attacker requires network reachability to the AdminServer port and valid low-privilege credentials recognized by ZooKeeper. Once authenticated, the attacker issues the AdminServer snapshot command to export the data tree or the restore command to overwrite state. No user interaction is required. See the Apache advisory thread for the maintainers' description of the flaw.

No public proof-of-concept exploit code is available at the time of publication.

Detection Methods for CVE-2025-58457

Indicators of Compromise

Unexpected snapshot or restore command entries in ZooKeeper AdminServer access logs originating from non-administrative client identities.
New or unfamiliar snapshot files appearing on hosts that receive AdminServer traffic.
Successful AdminServer HTTP requests to the /commands/snapshot or /commands/restore endpoints from unauthorized source addresses.

Detection Strategies

Enable ZooKeeper audit logging and alert on invocations of the snapshot and restore AdminServer commands.
Correlate AdminServer request logs with an allowlist of administrative principals and flag mismatches.
Monitor for outbound transfer of snapshot files from ZooKeeper hosts to unexpected destinations.

Monitoring Recommendations

Ingest ZooKeeper AdminServer and audit logs into a centralized analytics platform and retain them for at least 90 days.
Baseline normal administrative activity by user, source IP, and time window, then alert on deviations.
Track version strings reported by ZooKeeper ensembles to identify hosts still running versions 3.9.0 through 3.9.3.

How to Mitigate CVE-2025-58457

Immediate Actions Required

Upgrade all Apache ZooKeeper 3.9.x nodes to version 3.9.4 or later.
Inventory ZooKeeper ensembles and confirm whether the AdminServer interface is exposed beyond localhost.
Rotate any secrets, credentials, or tokens that may have been stored in znodes on affected clusters.

Patch Information

Apache ZooKeeper 3.9.4 fixes the improper permission check. Refer to the Apache Thread Notification and the Openwall OSS-Security update for release details.

Workarounds

Disable the snapshot and restore commands by setting admin.snapshot.enabled=false and admin.restore.enabled=false in the ZooKeeper configuration.
Disable the AdminServer entirely by setting admin.enableServer=false when operational tooling does not require it.
Ensure the root znode ACL does not grant open permissions, keeping in mind that ZooKeeper ACLs are non-recursive.
Restrict network access to the AdminServer port to administrative jump hosts only.

bash

# Configuration example: disable AdminServer snapshot/restore in zoo.cfg
admin.enableServer=true
admin.snapshot.enabled=false
admin.restore.enabled=false

# Or disable the AdminServer entirely
admin.enableServer=false