Apache ZooKeeper fails to enforce peer hostname verification when FIPS mode is enabled and quorum TLS settings are configured. A CA‑trusted certificate whose subject alternative name does not match the host name can be accepted, allowing a malicious or misissued peer to join the quorum. This compromised node can participate in leader election and replicate data, resulting in integrity loss and possible service disruption. The weakness corresponds to improper authentication (CWE-297).

The flaw affects any Apache ZooKeeper installation that enables sslQuorum, zookeeper.fips-mode, ssl.quorum.hostnameVerification, and ssl.quorum.clientHostnameVerification. All deployed versions lacking the vendor‑issued fix are vulnerable; the official fix is provided in ZooKeeper 3.8.7 and 3.9.6.

Because no EPSS score is available, the exact likelihood of exploitation is unknown, but the ability to subvert quorum membership poses a high‑impact threat to any ZooKeeper‑dependent services. The vulnerability is not listed in CISA KEV and could be exploited over the network or through a compromised node that can present a CA‑trusted but mismatched certificate.