CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.
45