Medium · 4.3 CVE-2025-58457 BIT-zookeeper-2025-58457EUVD-2025-30955GHSA-2hmj-97jw-28jh

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Published Sep 24, 2025 · Updated Nov 4, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache ZooKeeper Package: apache-activemq-artemis Package: apache-activemq-artemis-compat Package: kafka_exporter-strimzi-compat Package: kafka-strimzi-compat Package: org.apache.zookeeper:zookeeper Package: prometheus-jmx-exporter-strimzi-compat Package: spark-4.0 Package: spark-4.0-scala-2.13 Package: spark-4.0-scala-2.13-compat Package: strimzi-kafka-operator Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-base Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: zookeeper Package: zookeeper Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions.

This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4.

Users are recommended to upgrade to version 3.9.4, which fixes the issue.

The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache ZooKeeper	3.9.0 – < 3.9.4	3.9.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	zookeeper	3.9.4-1	—
Debian 13	zookeeper	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	zookeeper	No fix yet	—
Ubuntu 26.04 LTS	zookeeper	No fix yet	—
Ubuntu 25.10	zookeeper	No fix yet	—
Ubuntu 24.04 LTS	zookeeper	No fix yet	—
Ubuntu 22.04 LTS	zookeeper	No fix yet	—

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	zookeeper	No fix yet	—
Ubuntu Pro 18.04 LTS	zookeeper	No fix yet	—
Ubuntu Pro 16.04 LTS	zookeeper	No fix yet	—
Ubuntu Pro 14.04 LTS	zookeeper	No fix yet	—

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	apache-activemq-artemis +1	2.42.0-r9	—
Wolfi rolling	kafka-strimzi-compat +12	0.47.0-r8	—
Wolfi rolling	spark-4.0 +2	4.0.1-r1	—
Wolfi rolling	thingsboard +4	4.2-r7	—
Wolfi rolling	trino +58	476-r9	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.zookeeper:zookeeper	>= 3.9.0, < 3.9.4	3.9.4	GHSA-2hmj-97jw-28jh

Advisories 1

WID-SEC-2026-0783 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026

References

https://lists.apache.org/thread/r5yol0kkhx2fzw22pxk1ozwm3oc6yxrx vendor-advisory