CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.
- Affects ZooKeeper 3.8.0-3.8.6 and 3.9.0-3.9.5
- Missing ACL check during SetWatches reconnect replay
- Allows discovery of ACL-restricted paths via exists-watches side channel
- Rated critical by the project
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59739 | Missing ACL Check in Apache ZooKeeper SetWatches Replay Leaks Restricted Znode Paths | 7.5 | — |
From the original article
Posted by Andor Molnar on Sep 15 Severity: critical Affected versions: - Apache ZooKeeper (org. apache. zookeeper:zookeeper) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.