{"id":"GHSA-2hmj-97jw-28jh","summary":"Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands","details":"Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the `snapshot` and `restore` commands. The intended requirement is authentication and authorization on the root path (`/`) with **ALL** permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client.\n\n*   **Affected:** `org.apache.zookeeper:zookeeper` 3.9.0 through 3.9.3.\n*   **Fixed:** 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”).\n*   **Mitigations:**\n    *   Disable both commands (`admin.snapshot.enabled`, `admin.restore.enabled`).\n    *   Disable AdminServer (`admin.enableServer`).\n    *   Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive.\n    *   Upgrade to 3.9.4.","aliases":["BIT-zookeeper-2025-58457","CVE-2025-58457"],"modified":"2026-09-10T03:50:27.739283088Z","published":"2025-09-24T12:30:20Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-09-24T19:00:08Z","nvd_published_at":"2025-09-24T10:15:28Z","cwe_ids":["CWE-280"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58457"},{"type":"PACKAGE","url":"https://github.com/apache/zookeeper"},{"type":"WEB","url":"https://lists.apache.org/thread/r5yol0kkhx2fzw22pxk1ozwm3oc6yxrx"},{"type":"WEB","url":"https://zookeeper.apache.org/doc/current/zookeeperSnapshotAndRestore.html"},{"type":"WEB","url":"https://zookeeper.apache.org/doc/r3.9.4/releasenotes.html"},{"type":"WEB","url":"https://zookeeper.apache.org/security.html#CVE-2025-58457"},{"type":"WEB","url":"http://github.com/apache/zookeeper/commit/71e173fcbcc9deb784081cf867bd045df3c32635"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/09/24/10"}],"affected":[{"package":{"name":"org.apache.zookeeper:zookeeper","ecosystem":"Maven","purl":"pkg:maven/org.apache.zookeeper/zookeeper"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.9.4"}]}],"versions":["3.9.0","3.9.1","3.9.2","3.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-2hmj-97jw-28jh/GHSA-2hmj-97jw-28jh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}