# CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper.

When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepared (and authorized) after the setACL is submitted but before it commits is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree after the ACL change has taken effect. A client that currently holds a permission can use this window to perform operations requiring that permission through and after its revocation — for example, committing writes or deletes after losing write access, or re-granting itself full permissions, which persistently defeats the revocation. In deployments transitioning from the default OPEN_ACL_UNSAFE ACL to a restrictive ACL, any unauthenticated client can exploit this during the transition.

This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Apache Software Foundation / Apache ZooKeeper (org.apache.zookeeper:zookeeper): ≥ 3.9.0; ≤ 3.9.6 (affected, maven); ≥ 3.8.0; ≤ 3.8.7 (affected, maven). Source: CNA: apache

## Severity and prioritization

- CVSS 4.0: 6 (medium); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: apache

- CVSS 4.0: 6 (medium); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: security@apache.org

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-367

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://lists.apache.org/thread.html/r40gp594o64mycwybc3v9dtvrm0vos0l (CNA: apache; vendor-advisory)

- http://www.openwall.com/lists/oss-security/2026/11/03/9 (ADP: CVE)

- https://lists.apache.org/thread.html/r40gp594o64mycwybc3v9dtvrm0vos0l (security@apache.org)

## Provenance

- CNA: apache: https://www.cve.org/CVERecord?id=CVE-2026-100235; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100235; retrieved 2026-11-04; source updated 2026-11-04

Revision: 961b49fa3c5fed6cd6c556710b89a6e86bfc1d8a2494f5dca67b380bdd26da55

Canonical: https://y2.dev/cve/CVE-2026-100235

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.