A critical security flaw in Apache ZooKeeper allows unauthenticated attackers to bypass TLS hostname verification and compromise cluster integrity in FIPS-compliant environments.

This vulnerability occurs due to improper validation of certificates with host mismatches (CWE-297) when FIPS-mode and specific TLS quorum settings are enabled. An unauthenticated attacker can present a CA-trusted certificate with an invalid SAN to successfully join the ZooKeeper quorum.

The ability for a malicious actor to inject a node into a ZooKeeper quorum poses a severe risk to data consistency and system availability. By participating in leader election and replication, an attacker can manipulate distributed state, leading to unauthorized data modification or total service disruption. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to protect critical infrastructure dependencies.

Immediate Action: Upgrade to Apache ZooKeeper version 3.8.7 or 3.9.6, which contain the necessary fixes for peer hostname verification.

Proactive Monitoring: Monitor ZooKeeper cluster logs for unexpected peer connections or unauthorized nodes joining the quorum.

Compensating Controls: Ensure that network-level controls restrict access to the quorum ports to only trusted, authorized IP addresses, effectively limiting the attack surface while planning the upgrade.

Public Exploit Available: No (exploit_available: false)

Given the potential for cluster-wide compromise and the ease of exploitation for this unauthenticated flaw, organizations currently running Apache ZooKeeper in FIPS-mode must prioritize this update. Evaluate your deployment configuration immediately to confirm if the affected TLS settings are active and schedule the required version upgrade to versions 3.8.7 or 3.9.6 to ensure the integrity of your distributed coordination services.