CVE-2019-0201: Access control bypass in Apache ZooKeeper
Summary
CVE-2019-0201: Access control bypass in Apache ZooKeeper. Affects org.apache.zookeeper:zookeeper across 2 version ranges.
>= 1.0.0, < 3.4.14
>= 3.5.0, < 3.5.5
Fixed in 3.4.14 or 3.5.5, depending on the release line you run. How to fix ↓
Also tracked for
- zookeeper · Debian:11
The same CVE-2019-0201 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ZooKeeper is a distributed coordination service that allows applications to coordinate and synchronize tasks across a cluster of servers. It provides a simple and reliable way for distributed processes to communicate with each other. The vulnerability, identified as CVE-2019-0201, affects Apache ZooKeeper versions 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. This vulnerability allows an attacker to bypass access control and retrieve sensitive information from the ACL Id field, which is stored as plaintext. The DigestAuthenticationProvider, used for user authentication, overloads the Id field with the hash value. Consequently, unauthenticated or unprivileged users can disclose the unsalted hash value by making a getACL() request.
Vulnerability Detail
The vulnerability in Apache ZooKeeper allows unauthorized access to sensitive information. By exploiting this vulnerability, an attacker can retrieve the unsalted hash value used for user authentication. This can lead to further attacks, such as password cracking or impersonation of authenticated users. The vulnerability affects versions 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta of Apache ZooKeeper.
How To Fix
Latest published version: 3.9.6 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 3.4.143.4.14 -
>= 3.5.0, < 3.5.53.5.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of Apache ZooKeeper.
Conclusion
The vulnerability in Apache ZooKeeper allows unauthorized access to sensitive information, potentially leading to further attacks. It is crucial to upgrade to the fixed versions of Apache ZooKeeper to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.zookeeper:zookeeper →
FAQ
Apache ZooKeeper is a distributed coordination service that allows applications to coordinate and synchronize tasks across a cluster of servers.
Versions 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta of Apache ZooKeeper are affected.
The vulnerability allows unauthorized access to sensitive information, specifically the unsalted hash value used for user authentication.
To fix this vulnerability, upgrade to the fixed versions of Apache ZooKeeper: 3.4.14 for versions 1.0.0 to 3.4.13, and 3.5.5 for versions 3.5.0-alpha to 3.5.4-beta.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of Apache ZooKeeper.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.zookeeper:zookeeper.
