CVE-2025-58457: Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Published Sep 24, 2025
·
Updated

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions.

This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4.

Users are recommended to upgrade to version 3.9.4, which fixes the issue.

The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)

Other sources

Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the snapshot and restore commands. The intended requirement is authentication and authorization on the root path (/) with ALL permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client.

Affected: org.apache.zookeeper:zookeeper 3.9.0 through 3.9.3. Fixed: 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”). Mitigations: Disable both commands (admin.snapshot.enabled, admin.restore.enabled). Disable AdminServer (admin.enableServer). Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive. Upgrade to 3.9.4.

— GitHub

Affected Software

3 affected componentsFixes available
Apache Zookeeper>=3.9.0, <3.9.4
maven/org.apache.zookeeper:zookeeper>=3.9.0<3.9.4
3.9.4
Apache Zookeeper>=3.9.0<3.9.4

Event History

Sep 24, 2025
CVE Published
via MITRE·09:29 AM
Data Sourced
via MITRE·09:29 AM
DescriptionWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·12:30 PM
Data Sourced
via GitHub·12:30 PM
DescriptionSeverityWeaknessAffected Software
Jan 30, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-58457?

CVE-2025-58457 has a moderate severity level due to improper permission checks allowing unauthorized command execution.

2

How do I fix CVE-2025-58457?

To fix CVE-2025-58457, upgrade Apache ZooKeeper to version 3.9.4 or later.

3

Which versions of Apache ZooKeeper are affected by CVE-2025-58457?

CVE-2025-58457 affects Apache ZooKeeper versions from 3.9.0 up to, but not including, 3.9.4.

4

What commands can be executed due to CVE-2025-58457?

Due to CVE-2025-58457, unauthorized clients can run snapshot and restore commands despite lacking sufficient permissions.

5

Is CVE-2025-58457 specific to a particular operating system?

CVE-2025-58457 is not specific to any operating system; it affects any system running the vulnerable versions of Apache ZooKeeper.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2025-58457 - Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands - SecAlerts