CVE-2026-59739
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
CVE-2026-59739- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-80330
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
EUVD-2026-80330- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wrgg-c9rw-j78f
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL...
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
GHSA-wrgg-c9rw-j78f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
CVE-2026-59739- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
CVE-2026-59739- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-59739
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
DEBIAN-CVE-2026-59739- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHLW-2026-19f4511248f79d69
Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015
Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.
CVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling
CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.
- Record
RHLW-2026-19f4511248f79d69- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-10
OSVUBUNTU-CVE-2026-59739
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
UBUNTU-CVE-2026-59739- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-zookeeper-2026-59739No score
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
- Record
BIT-zookeeper-2026-59739- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zookeeperBitnami | 3.8.0 up to 3.8.7, 3.9.0 up to 3.9.6 | 3.8.73.9.6 |
zookeeperDebian:12 | All versions, plus listed versions 3.8.0-113.8.0-11+deb12u13.8.0-11+deb12u23.9.1-13.9.2-1 Show 8 moreShow less3.9.2-23.9.3-13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 | None known |
zookeeperDebian:13 | All versions, plus listed versions 3.9.3-13.9.3-1+deb13u13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 | None known |
zookeeperDebian:14 | before 3.9.6-1, plus listed versions 3.9.3-13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-2 | 3.9.6-1 |
org.apache.zookeeper:zookeeperRed Hat Lightwell:Maven From an advisory covering 7 CVEs | before 3.8.3.rhlw-00015, plus listed versions 3.3.03.3.13.3.23.3.33.3.4 Show 40 moreShow less3.3.53.3.63.4.03.4.13.4.103.4.113.4.123.4.133.4.143.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.0-alpha3.5.1-alpha3.5.103.5.2-alpha3.5.3-beta3.5.4-beta3.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.8.03.8.13.8.23.8.3 | 3.8.3.rhlw-00015 |
zookeeperUbuntu:Pro:14.04:LTS | All versions, plus listed versions 3.4.5+dfsg-13.4.5+dfsg-1ubuntu0.1~esm13.4.5+dfsg-1ubuntu0.1~esm3 | None known |
zookeeperUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.4.6-83.4.7-13.4.8-13.4.8-1ubuntu0.1~esm13.4.8-1ubuntu0.1~esm2 | None known |
zookeeperUbuntu:Pro:18.04:LTS | All versions, plus listed versions 3.4.10-23.4.10-33.4.13-33.4.13-3ubuntu0.1~esm1 | None known |
zookeeperUbuntu:20.04:LTS | All versions, plus listed versions 3.4.13-13.4.13-33.4.13-3build13.4.13-43.4.13-53.4.13-5build13.4.13-5ubuntu0.1 | None known |
zookeeperUbuntu:22.04:LTS | All versions, plus listed versions 3.4.13-5ubuntu43.4.13-6ubuntu23.4.13-6ubuntu33.4.13-6ubuntu43.4.13-6ubuntu4.1 | None known |
zookeeperUbuntu:24.04:LTS | All versions, plus listed versions 3.8.0-113.9.1-13.9.1-1build13.9.1-1build2 | None known |
zookeeperUbuntu:26.10 | All versions, plus listed versions 3.9.5-13.9.5-2 | None known |
zookeeperUbuntu:26.04:LTS | All versions, plus listed versions 3.9.3-1build23.9.3-1build33.9.4-13.9.5-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59739 is a high vulnerability (CVSS 7.5) in Apache Zookeeper, published September 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in zookeeper 3.8.7.
References
lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l
nvd.nist.gov/vuln/detail/CVE-2026-59739
github.com/advisories/GHSA-wrgg-c9rw-j78f
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-59739
Show 29 moreShow less
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json
access.redhat.com/errata/RHSA-2026:10184
ubuntu.com/security/CVE-2026-59739
cve.org/CVERecord?id=CVE-2026-59739