Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths,…

Info

CVECVE-2026-59739

First seen2026-09-16 11:16 UTC

Disclosed2026-09-16 10:16 UTC

Last updated2026-09-16 11:16 UTC

Channel statusauto

Summary

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls wa…

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l

Timeline

2026-09-16 nvd_ingest NVD