Log in Start free

Vulnerability · Published Sep 24, 2025 · Assigned by apache

CVE-2025-58457Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Medium 4.3

In plain English

A medium-severity security flaw in Apache ZooKeeper from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 72.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13zookeeperno fix listedDEBIAN-CVE-2025-58457
Debian:14zookeeper3.9.4-1DEBIAN-CVE-2025-58457
Mavenorg.apache.zookeeper:zookeeper3.9.4GHSA-2hmj-97jw-28jh
Ubuntu:22.04:LTSzookeeperno fix listedUBUNTU-CVE-2025-58457
Ubuntu:24.04:LTSzookeeperno fix listedUBUNTU-CVE-2025-58457
Ubuntu:25.10zookeeperno fix listedUBUNTU-CVE-2025-58457
Ubuntu:26.04:LTSzookeeperno fix listedUBUNTU-CVE-2025-58457
Ubuntu:26.10zookeeperno fix listedUBUNTU-CVE-2025-58457

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache ZooKeeper 3.9.0 – before 3.9.4

Weakness: CWE-280 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References