// What runs on ZooKeeper / accumulo
Does Apache Accumulo use ZooKeeper?
RequiredYes. Accumulo requires HDFS and ZooKeeper to be configured and running before it starts, in every release line. Configuration, server locks and table operation state all live in ZooKeeper. Even the Accumulo 4.0 alpha, which moves user fault-tolerant executor (FaTE) transactions into a table, keeps system FaTE transactions in ZooKeeper.
Trusted globally by enterprises
What Apache Accumulo uses ZooKeeper for
- Instance and table configuration. Table properties live in ZooKeeper, which is why the install guide keeps custom properties to tens, none over 1 MB.
- Tablet server locks. Each tablet server holds a ZooKeeper lock over its assigned tablets; if it loses the lock, it shuts itself down and the cluster treats it as dead.
- Locks and registration for the Manager and other server processes, including external compactors.
- Fault-tolerant executor (FaTE) transaction state for multi-step table operations.
- Client bootstrap: clients connect with instance.name and instance.zookeepers and find the servers through ZooKeeper.
Which ZooKeeper version ships with Apache Accumulo
From the zookeeper.version property (version.zookeeper from 2.1.2 on) in pom.xml at each release tag: the version Accumulo is built and tested against. The binary tarball does not ship ZooKeeper. accumulo-env.sh (general.classpaths in 1.x) adds the jars from ZOOKEEPER_HOME to the classpath, so at runtime Accumulo uses the client from the ZooKeeper installation on each host.
| Release | ZooKeeper | ZooKeeper line status | Open ZooKeeper CVEs |
|---|---|---|---|
| Accumulo 1.9.3 | 3.4.6 | End of life since 1 June 2020Bundles log4j 1.2.17 | 3 (CVE-2018-8012, CVE-2019-0201, CVE-2023-44981)2026 advisories not assessed for this line |
| Accumulo 1.10.0 to 1.10.41.10 end of life with 1.10.4, November 2023 | 3.4.14 | End of life since 1 June 2020Bundles log4j 1.2.17 | 1 (CVE-2023-44981)2026 advisories not assessed for this line |
| Accumulo 2.0.1 | 3.4.14 | End of life since 1 June 2020Bundles log4j 1.2.17 | 1 (CVE-2023-44981)2026 advisories not assessed for this line |
| Accumulo 2.1.0 | 3.8.0 | Supported (latest 3.8.7) | 7 (CVE-2023-44981, CVE-2024-23944, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Accumulo 2.1.1 | 3.8.1 | Supported (latest 3.8.7) | 7 (CVE-2023-44981, CVE-2024-23944, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Accumulo 2.1.2 and 3.0.0 | 3.8.2 | Supported (latest 3.8.7) | 7 (CVE-2023-44981, CVE-2024-23944, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Accumulo 2.1.3 | 3.9.2 | Supported (latest 3.9.6) | 7 (CVE-2024-51504, CVE-2025-58457, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Accumulo 2.1.4 | 3.9.3 | Supported (latest 3.9.6) | 6 (CVE-2025-58457, CVE-2026-24281, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
| Accumulo 2.1.5, 2.1.6 and 4.0.0-alpha-1 | 3.9.5 | Supported (latest 3.9.6) | 3 (CVE-2026-59739, CVE-2026-59969, CVE-2026-79993) |
CVE counts are ZooKeeper's own advisories matched against the upstream version. The Apache ZooKeeper project does not assess end-of-life lines against new advisories, so "not assessed" means unknown, not safe.
What ZooKeeper 3.4.6 is exposed to
CVE-2018-8012 · CVSS 7.5 · fixed in 3.4.10, 3.5.4-beta
No authentication or authorisation on servers joining the quorum, so a rogue peer can push changes to the leader.
CVE-2019-0201 · CVSS 5.9 · fixed in 3.4.14, 3.5.5
getACL() performs no permission check and exposes unsalted digest authentication hashes.
CVE-2023-44981 · CVSS 9.1 · fixed in 3.7.2, 3.8.3, 3.9.1
SASL quorum peer authentication bypass, giving full read-write access to the data tree. Applies when quorum.auth.enableSasl=true.
Find the ZooKeeper Accumulo is using
# Ensemble address (accumulo.properties in 2.x, accumulo-site.xml in 1.x) grep -E '^instance.zookeeper.host' conf/accumulo.properties grep -A1 instance.zookeeper.host conf/accumulo-site.xml # Accumulo loads the ZooKeeper jars from ZOOKEEPER_HOME at runtime accumulo classpath | tr ':' '\n' | grep -i zookeeper # Version of the ensemble echo srvr | nc zk1.internal 2181 | head -1
Can Apache Accumulo run without ZooKeeper?
No. The install guide for 2.x and for the 4.x preview both say HDFS and ZooKeeper must be configured and running before Accumulo starts. In 4.0.0-alpha-1, user FaTE transactions move into a table in the system namespace, but system FaTE transactions stay in ZooKeeper.
Accumulo 2.1.6 (17 July 2026) is the latest release of the 2.1 long-term maintenance (LTM) line, and 3.0.0 is the latest non-LTM release. 4.0.0-alpha-1 (24 September 2026) is a test release that the project says not to use in production. The 1.10 line ended with 1.10.4 in November 2023.
Your options
Upgrade to Accumulo 2.1
The project's recommended path from 1.10. 2.1.5 and 2.1.6 build against ZooKeeper 3.9.5, and the upgrade moves Accumulo, ZooKeeper and Hadoop together, with client and iterator testing.
Patch Accumulo 1.10 and its ZooKeeper
OSSeva ships patched Accumulo 1.10 builds and patched ZooKeeper 3.4 for the ensemble and the ZOOKEEPER_HOME jars Accumulo loads, with the Hadoop layer beside it covered too.
Most teams buy this at the product level: keep the Apache Accumulo estate supported, including the ZooKeeper under it. See Accumulo extended support.
Frequently asked questions
Can Accumulo run without ZooKeeper?
No. Every Accumulo release requires ZooKeeper and HDFS, including the 4.0 alpha.
Which ZooKeeper does Accumulo 1.10 use?
Accumulo 1.10.0 to 1.10.4 build against ZooKeeper 3.4.14. The 3.4 line reached end of life on 1 June 2020, and 3.4.14 has no fix for CVE-2023-44981.
Which ZooKeeper does Accumulo 2.1 use?
2.1.0 built against 3.8.0, and 2.1.5 and 2.1.6 build against 3.9.5. At runtime Accumulo loads the jars from ZOOKEEPER_HOME, so the ZooKeeper installed on each host is the client that actually runs.
Why is the ZooKeeper section of the Accumulo monitor empty?
The monitor uses the ZooKeeper stat four-letter-word command. ZooKeeper 3.5.3 and later only allow srvr by default, so stat has to be added to 4lw.commands.whitelist.
Keep Apache Accumulo and the ZooKeeper under it supported.
Send us your versions; we reply with coverage, exposure and a plan within five working days.