CVE-2018-8012: Missing Authorization in Apache ZooKeeper
Summary
CVE-2018-8012: Missing Authorization in Apache ZooKeeper. Affects org.apache.zookeeper:zookeeper across 2 version ranges.
< 3.4.10
>= 3.5.0-alpha, < 3.5.4-beta
Fixed in 3.4.10 or 3.5.4-beta, depending on the release line you run. How to fix ↓
Also tracked for
- zookeeper · Debian:11
The same CVE-2018-8012 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ZooKeeper is a distributed coordination service that allows applications to coordinate and synchronize tasks in a distributed environment. It provides a hierarchical key-value store, similar to a file system, where data can be stored and accessed by multiple clients. ZooKeeper is widely used in distributed systems to maintain configuration information, provide distributed locks, and manage group membership. However, versions before 3.4.10 and 3.5.0-alpha through 3.5.3-beta suffer from a vulnerability that allows unauthorized servers to join a quorum and propagate counterfeit changes to the leader.
Vulnerability Detail
The vulnerability (CVE-2018-8012) in Apache ZooKeeper allows an arbitrary endpoint to join the cluster without authentication or authorization. This means that an attacker can exploit the vulnerability to join the cluster and start propagating counterfeit changes to the leader. The lack of authentication and authorization enforcement poses a significant risk to the integrity and security of the distributed system. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.9.6 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.4.103.4.10 -
>= 3.5.0-alpha, < 3.5.4-beta3.5.4-beta
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions as soon as possible to mitigate the risk.
Conclusion
In conclusion, the vulnerability (CVE-2018-8012) in Apache ZooKeeper allows unauthorized servers to join the cluster and propagate counterfeit changes. To mitigate the risk, it is essential to upgrade to the fixed versions of Apache ZooKeeper as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.zookeeper:zookeeper →
FAQ
Apache ZooKeeper is a distributed coordination service that allows applications to coordinate and synchronize tasks in a distributed environment. It provides a hierarchical key-value store and is widely used in distributed systems.
The vulnerability allows unauthorized servers to join the cluster and propagate counterfeit changes to the leader, compromising the integrity and security of the distributed system.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix the vulnerability, it is recommended to upgrade to the fixed versions of Apache ZooKeeper (3.4.10 or later for versions before 3.4.10, and 3.5.4-beta or later for versions 3.5.0-alpha through 3.5.3-beta).
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.zookeeper:zookeeper.
