{"id":"CVE-2025-58457","aliases":["BIT-zookeeper-2025-58457","GHSA-2hmj-97jw-28jh"],"url":"https://o3.security/vulnerability/CVE-2025-58457","summary":"Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands","details":"Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the `snapshot` and `restore` commands. The intended requirement is authentication and authorization on the root path (`/`) with **ALL** permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client.\n\n*   **Affected:** `org.apache.zookeeper:zookeeper` 3.9.0 through 3.9.3.\n*   **Fixed:** 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”).\n*   **Mitigations:**\n    *   Disable both commands (`admin.snapshot.enabled`, `admin.restore.enabled`).\n    *   Disable AdminServer (`admin.enableServer`).\n    *   Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive.\n    *   Upgrade to 3.9.4.","published":"2025-09-24T09:29:35.824Z","modified":"2026-08-12T03:51:10.385624869Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00315,"percentile":0.24439,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.zookeeper:zookeeper","fixedVersion":"3.9.4"}],"fix":{"url":"http://github.com/apache/zookeeper/commit/71e173fcbcc9deb784081cf867bd045df3c32635","label":"apache/zookeeper@71e173f"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/09/24/10"},{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58457.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/r5yol0kkhx2fzw22pxk1ozwm3oc6yxrx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58457"},{"type":"PACKAGE","url":"https://github.com/apache/zookeeper"},{"type":"WEB","url":"https://zookeeper.apache.org/doc/current/zookeeperSnapshotAndRestore.html"},{"type":"WEB","url":"https://zookeeper.apache.org/doc/r3.9.4/releasenotes.html"},{"type":"WEB","url":"https://zookeeper.apache.org/security.html#CVE-2025-58457"},{"type":"WEB","url":"http://github.com/apache/zookeeper/commit/71e173fcbcc9deb784081cf867bd045df3c32635"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:10.385624869Z"}}