CVE-2026-59739

Apache ZooKeeper fails to enforce ACLs when replaying a client's registered watches during session reconnection, an information-disclosure flaw (CWE-862, missing authorization) in the reconnect SetWatches/SetWatches2 handler. An attacker connects to the ZooKeeper client port and registers exists-watches on guessed paths that do not yet exist; after those paths are created with restricted ACLs, the attacker reconnects, and DataTree.setWatches() calls watcher.process(event) with a null ACL, bypassing the check that was added to WatchManager.triggerWatch() as an incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The attacker learns only that the ACL-protected paths exist, not the znode data, but path names can embed sensitive values such as usernames or login IDs, making the leak potentially critical. Any deployment of ZooKeeper 3.8.x before 3.8.7 or 3.9.x before 3.9.6 where clients can reach the client port is affected. No public PoC is known, the issue is not in CISA KEV, and CVSS has not yet been scored.

What to do: Upgrade to ZooKeeper 3.9.6 or 3.8.7, the fixed patch releases for each branch. Restrict network access to the ZooKeeper client port (default 2181) to trusted hosts and subnets, since the attack only requires client connectivity to register and replay watches. Assume ACL-protected znode paths may have been enumerated on long-lived clusters and review whether those path names embed usernames or other sensitive identifiers.