CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:zookeeper::::::::
	cpe:2.3:a:apache:zookeeper::::::::

History

18 Sep 2026, 14:37

Type	Values Removed	Values Added
References	~~() https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l -~~	() https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l - Mailing List, Vendor Advisory
First Time		Apache Apache zookeeper
CPE		cpe:2.3:a:apache:zookeeper::::::::

17 Sep 2026, 20:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

Information

Published : 2026-09-16 10:16

Updated : 2026-09-18 14:37

NVD link : CVE-2026-59739

Mitre link : CVE-2026-59739

CVE.ORG link : CVE-2026-59739

JSON object : View

Products Affected

apache

zookeeper

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-59739", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59739", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T19:17:33.790349Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache ZooKeeper", "versions": [{"status": "affected", "version": "3.9.0", "versionType": "maven", "lessThanOrEqual": "3.9.5"}, {"status": "affected", "version": "3.8.0", "versionType": "semver", "lessThanOrEqual": "3.8.6"}], "packageURL": "pkg:maven/org.apache.zookeeper/zookeeper", "packageName": "org.apache.zookeeper:zookeeper", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-09-16T10:16:51.097", "references": [{"url": "https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check.\u00a0An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for\u00a0CVE-2024-23944 (ZOOKEEPER-4799).\u00a0The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() \u2014 the SetWatches/SetWatches2 reconnect replay handler \u2014 still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.\n\nUsers are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue."}], "lastModified": "2026-09-18T14:37:10.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EB0BE5E-6F39-4D77-BBEC-89AE61429E31", "versionEndExcluding": "3.8.7", "versionStartIncluding": "3.8.0"}, {"criteria": "cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78E0C560-E216-4628-9131-E8C919D8B937", "versionEndExcluding": "3.9.6", "versionStartIncluding": "3.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}