Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by apache

CVE-2026-59739Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

High 7.5

In plain English

A high-severity missing authorization in Apache ZooKeeper from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zookeeperno fix listedDEBIAN-CVE-2026-59739
Debian:13zookeeperno fix listedDEBIAN-CVE-2026-59739
Debian:14zookeeper3.9.6-1DEBIAN-CVE-2026-59739
Ubuntu:22.04:LTSzookeeperno fix listedUBUNTU-CVE-2026-59739
Ubuntu:24.04:LTSzookeeperno fix listedUBUNTU-CVE-2026-59739
Ubuntu:26.04:LTSzookeeperno fix listedUBUNTU-CVE-2026-59739
Ubuntu:26.10zookeeperno fix listedUBUNTU-CVE-2026-59739

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache ZooKeeper 3.9.0 – through 3.9.53.8.0 – through 3.8.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References