Cyber ·
CVE-2026-100235: ACL bypass in Apache ZooKeeper allows pending changes after revocation
Advisory dated November 3, 2026: a TOCTOU race condition in setACL handling in Apache ZooKeeper can let pending changes be committed after an ACL is revoked. Moderate severity, CVSS 4.0 score 6.0.
Advisory CVE-2026-100235 was published by Andor Molnar on the oss-sec feed on November 3, 2026. The text received is an automatic translation and states moderate severity, with CVSS 4.0 score 6.0 (medium) and vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. The listed affected versions are Apache ZooKeeper 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7. The description refers to incorrect authorization caused by a time-of-check to time-of-use (TOCTOU) race condition in handling setACL requests: when a node's ACL is changed through setACL, the pending change is not published to, and the received text stops at that point.
The relevance lies in environments running these ZooKeeper versions, where a permission revocation may not be enforced immediately. Rota Nacional does not host or patch ZooKeeper and offers no capability for this flaw. To assess impact, read the original advisory, which contains the full description, fixed versions and any mitigations, since the received text is truncated.