Improper validation of certificate with host mismatch in Apache ZooKeeper - CVE-2026-59969
Published: September 16, 2026
Vulnerability identifier: #VU150216
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59969
CWE-ID: CWE-297
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to join quorum traffic and participate in leader election and replication flows.
The vulnerability exists due to improper validation of certificate hostnames in the Java SSLSocket quorum path when processing a CA-trusted peer certificate whose SAN does not match the connected host in a FIPS-mode deployment. A remote user can present such a peer certificate to join quorum traffic and participate in leader election and replication flows.
Affected software
Apache ZooKeeper
IBM SPSS Modeler
IBM Netezza Performance Server
InfoSphere Data Replication
IBM SPSS Modeler
IBM Netezza Performance Server
InfoSphere Data Replication
How to mitigate CVE-2026-59969
Install security update from vendor's website.
Apache ZooKeeper - addressed in versions 3.8.7, 3.9.6
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826