GHSA-2hmj-97jw-28jh Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

• Maven org.apache.zookeeper:zookeeper: >= 3.9.0, < 3.9.4 → fixed in 3.9.4

Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the `snapshot` and `restore` commands. The intended requirement is authentication and authorization on the root path (`/`) with ALL permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client. • Affected: `org.apache.zookeeper:zookeeper` 3.9.0 through 3.9.3. • Fixed: 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”). • Mitigations: • Disable both commands (`admin.snapshot.enabled`, `admin.restore.enabled`). • Disable AdminServer (`admin.enableServer`). • Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive. • Upgrade to 3.9.4.