{"id":"CVE-2026-79993","aliases":["BIT-zookeeper-2026-79993","DEBIAN-CVE-2026-79993","EUVD-2026-80332","GHSA-9x9g-5r48-3wvg","GHSA-crhr-qqj8-rpxc","GHSA-r978-9m6m-6gm6","RHLW-2026-19f4511248f79d69","UBUNTU-CVE-2026-79993"],"status":"published","title":"Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00603,"percentile":0.49353,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-09-16T09:27:22Z","modified":"2026-11-10T08:43:12Z","fixes":[{"ecosystem":"Bitnami","package":"zookeeper","fixed_in":["3.8.7","3.9.6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zookeeper","fixed_in":["3.9.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"zookeeper","ranges":[{"type":"SEMVER","events":[{"introduced":"3.8.0"},{"fixed":"3.8.7"},{"introduced":"3.9.0"},{"fixed":"3.9.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.8.0-11+deb12u1","3.8.0-11+deb12u2","3.9.1-1","3.9.2-1","3.9.2-2","3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1","3.9.3-1+deb13u1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2","3.9.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.6-1"}]}],"versions":["3.9.3-1","3.9.3-2","3.9.4-1","3.9.4-2","3.9.5-1","3.9.5-2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3.rhlw-00015"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.14","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0-alpha","3.5.1-alpha","3.5.10","3.5.2-alpha","3.5.3-beta","3.5.4-beta","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.8.0","3.8.1","3.8.2","3.8.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.5+dfsg-1","3.4.5+dfsg-1ubuntu0.1~esm1","3.4.5+dfsg-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.6-8","3.4.7-1","3.4.8-1","3.4.8-1ubuntu0.1~esm1","3.4.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.10-2","3.4.10-3","3.4.13-3","3.4.13-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-1","3.4.13-3","3.4.13-3build1","3.4.13-4","3.4.13-5","3.4.13-5build1","3.4.13-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.13-5ubuntu4","3.4.13-6ubuntu2","3.4.13-6ubuntu3","3.4.13-6ubuntu4","3.4.13-6ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-11","3.9.1-1","3.9.1-1build1","3.9.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.5-1","3.9.5-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.3-1build2","3.9.3-1build3","3.9.4-1","3.9.5-1"]}],"products":[{"vendor":"apache","product":"zookeeper"},{"vendor":"apache software foundation","product":"apache zookeeper"}],"references":[{"url":"https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/15/5","tags":["Mailing List","discussion","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79993","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9x9g-5r48-3wvg"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79993.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79993","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23944.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23944","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r978-9m6m-6gm6","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14276","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24308","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24308.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24308","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-crhr-qqj8-rpxc","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59739.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59739","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59969.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59969","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84439.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84439","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84501.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84501","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-79993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79993","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-79993","title":"Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-16T09:27:22.516Z","modified":"2026-09-17T19:16:04.241Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-80332","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-16T09:27:22Z","modified":"2026-09-17T19:16:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:10.042182Z"}],"ghsa":[{"id":"GHSA-9x9g-5r48-3wvg","title":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL...","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-16T12:30:31Z","modified":"2026-09-17T21:31:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:12:08.779152Z"}],"nvd":[{"id":"CVE-2026-79993","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-16T10:16:53.19Z","modified":"2026-09-18T14:37:21.703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"CVE-2026-79993","title":"Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-16T09:27:22.516Z","modified":"2026-10-28T02:30:49.806624524Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"DEBIAN-CVE-2026-79993","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.  This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.  Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-16T10:16:53.19Z","modified":"2026-10-01T03:03:35.24035893Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:04.001673Z"},{"id":"RHLW-2026-19f4511248f79d69","title":"Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015","description":"Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.\n\nCVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling\n\nCVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling\n\nCVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay\n\nCVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode\n\nCVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode\n\nCVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources\n\nCVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider\n\nThis patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.","status":"published","published":"2026-11-09T00:50:22Z","modified":"2026-11-10T08:43:12.631396777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-10T08:55:24.395105Z"},{"id":"UBUNTU-CVE-2026-79993","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-16T10:16:00Z","modified":"2026-10-17T13:01:10.231233203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"BIT-zookeeper-2026-79993","title":"Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode","description":"The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.","status":"published","published":"2026-09-19T08:51:29.07Z","modified":"2026-09-19T09:15:03.072758803Z","updated_at":"2026-11-02T15:28:36.455807Z"}]}}