Not rated
CVE-2018-8012 No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10,…
Description
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ZooKeeper | Versions not published |
Other CVEs of Apache ZooKeeper
The 19 CVEs of Apache ZooKeeper →
CVE-2026-100302
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
7.1
High
CVE-2026-115448
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
8.7
High
CVE-2026-100300
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
8.7
High
CVE-2026-100252
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
8.6
High