CVE-2026-59969: Apache ZooKeeper TLS Verification Bypass

CVE-2026-59969 Overview

CVE-2026-59969 is a certificate validation flaw in Apache ZooKeeper's quorum Transport Layer Security (TLS) implementation. When deployments enable Federal Information Processing Standards (FIPS) mode along with quorum hostname verification, the Java SSLSocket quorum path fails to enforce peer hostname checks. A Certificate Authority (CA)-trusted certificate whose Subject Alternative Name (SAN) does not match the connected host is accepted as valid. This weakness allows a malicious or misissued peer certificate to join quorum traffic, participate in leader election, and enter replication flows. The vulnerability is tracked under [CWE-297: Improper Validation of Certificate with Host Mismatch].

Critical Impact
An attacker holding a CA-trusted but non-matching certificate can join the ZooKeeper quorum, influence leader election, and inject data into replication streams.

Affected Products

Apache ZooKeeper versions prior to 3.8.7
Apache ZooKeeper 3.9.x versions prior to 3.9.6
ZooKeeper deployments running with sslQuorum=true and zookeeper.fips-mode=true

Discovery Timeline

2026-09-16 - CVE-2026-59969 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-59969

Vulnerability Analysis

Apache ZooKeeper uses quorum TLS to authenticate peers participating in leader election and replication. Administrators enable this protection by setting sslQuorum=true together with ssl.quorum.hostnameVerification=true and ssl.quorum.clientHostnameVerification=true. In non-FIPS mode, the quorum socket layer enforces SAN or Common Name (CN) matching against the peer hostname.

When zookeeper.fips-mode=true is set, the code path switches to Java SSLSocket primitives. On that path, the hostname verification step is not applied to peer certificates. The socket layer trusts any certificate chain that a configured CA signed, regardless of whether the SAN matches the connecting host.

The result is a broken certificate binding between identity and network endpoint. An adversary with any CA-issued certificate trusted by the ensemble can present it from an unauthorized host and be accepted as a legitimate quorum member.

Root Cause

The root cause is missing hostname verification on the FIPS-mode Java SSLSocket code path. The quorum TLS handler validates chain of trust but omits the SAN-to-host comparison required to bind the certificate to the peer endpoint. This is a classic instance of [CWE-297], where certificate validation succeeds without confirming that the presented identity matches the connection target.

Attack Vector

An attacker needs a certificate signed by a CA the ZooKeeper ensemble already trusts. Sources include misissued certificates, compromised internal CAs, or shared enterprise trust stores. The attacker connects to the quorum port from an unauthorized host, presents the certificate, and passes the incomplete verification check. Once inside the quorum, the attacker can vote in leader election, inject writes through replication, and observe cluster state. Full technical context is available in the Apache Security Mailing List Thread and the OpenWall OSS-Security Update.

Detection Methods for CVE-2026-59969

Indicators of Compromise

Quorum peer connections originating from IP addresses not in the ensemble configuration file (zoo.cfg).
Unexpected leader election events or view changes without corresponding operational activity.
TLS handshake logs showing peer certificates whose SAN does not match any configured ensemble host.
New or unknown server.N participants appearing in ZooKeeper metrics or JMX output.

Detection Strategies

Audit ZooKeeper server logs for QuorumCnxManager connection events and correlate source addresses against the declared ensemble membership.
Inspect the presented peer certificate SANs during quorum TLS handshakes and alert when SAN values do not match expected hostnames.
Compare running ensemble state against the static zoo.cfg to identify unauthorized participants.

Monitoring Recommendations

Forward ZooKeeper quorum logs and TLS handshake metadata into a centralized logging platform for anomaly analysis.
Alert on repeated leader election transitions, epoch changes, or replication anomalies.
Monitor issuance events on any CA whose root is trusted by ZooKeeper truststores.

How to Mitigate CVE-2026-59969

Immediate Actions Required

Upgrade Apache ZooKeeper to version 3.8.7 or 3.9.6, which enforce hostname verification on the FIPS-mode quorum path.
Inventory all ZooKeeper deployments running zookeeper.fips-mode=true with sslQuorum=true and prioritize them for patching.
Rotate any certificates issued by CAs whose trust scope extends beyond the ZooKeeper ensemble.
Restrict network access to quorum ports so only known ensemble members can reach them.

Patch Information

The Apache ZooKeeper project has released fixed builds in versions 3.8.7 and 3.9.6. These releases restore SAN and hostname enforcement on the FIPS-mode SSLSocket code path. Refer to the Apache Security Mailing List Thread for the vendor advisory.

Workarounds

Disable FIPS mode by setting zookeeper.fips-mode=false if operational policy permits, which restores the standard hostname verification path.
Use a dedicated private CA that issues certificates only for ZooKeeper ensemble members, narrowing the pool of trusted certificates.
Enforce network-level allowlisting on quorum ports (default 2888 and 3888) using host firewalls or segmentation.

bash

# Configuration example: restrict trust store to ensemble-only CA and enforce hostname verification
sslQuorum=true
ssl.quorum.hostnameVerification=true
ssl.quorum.clientHostnameVerification=true
ssl.quorum.trustStore.location=/etc/zookeeper/ssl/ensemble-truststore.jks
ssl.quorum.keyStore.location=/etc/zookeeper/ssl/server-keystore.jks
# Firewall example: allow quorum ports only from ensemble members
iptables -A INPUT -p tcp -m multiport --dports 2888,3888 -s 10.0.0.11,10.0.0.12,10.0.0.13 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 2888,3888 -j DROP