TI-2026-42604 Aliases CVE-2026-59739 GHSA-wrgg-c9rw-j78f

Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

MEDIUM 40CWE-862Published 2026-09-16 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-862.

Summary

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00553 46th percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache ZooKeeper	3.9.0 – 3.9.5; 3.8.0 – 3.8.6	—	No fix listed	CNA

Apache ZooKeeper VendorApache Affected 3.9.0 – 3.9.5; 3.8.0 – 3.8.6 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:zookeeper::::::::	3.8.0 to before 3.8.7; 3.9.0 to before 3.9.6	Vulnerable	Apache

cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions 3.8.0 to before 3.8.7; 3.9.0 to before 3.9.6 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat Offline Knowledge Portal	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 16.2	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-59739
2026-10-03 Alias added: GHSA-wrgg-c9rw-j78f

References

Advisory 1

https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l

TI-2017-03638 Missing authentication in Apache ZooKeeper CVSS 3.0HIGH 7.5
TI-2023-24043 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication CVSS 3.1CRITICAL 9.1
TI-2021-04395 Possible request smuggling in HTTP/2 due missing validation CVSS 3.1MEDIUM 5.9
TI-2024-34425 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server CVSS 3.1CRITICAL 9.1
TI-2016-04336 Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before… CVSS 3.0HIGH 8.1
TI-2018-05789 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences