CVE-2026-59739

highPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.006 · 46. PerzentilUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.55% (46th) EPSS

CVSS 7.5 · high

Is it mine?

4 products

Prüfe deine Angriffsfläche

Who says so?

2 sources

nvd · osv

EPSS · bewertet 2026-10-28

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NsecondaryAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-862US

betroffene Produkte (4)

Betroffene Produkte und Versionsbereiche.

apache zookeeper3.8.0 → 3.8.7nvdUScpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
apache zookeeper3.9.0 → 3.9.6nvdUScpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
Bitnami zookeeper3.8.0 → 3.8.7osvUSpkg:bitnami/zookeeper
Bitnami zookeeper3.9.0 → 3.9.6osvUSpkg:bitnami/zookeeper

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

BIT-zookeeper-2026-59739Apache ZooKeeper: Information disclosure via SetWatches reconnect replay2026-09-19vendor · osvUS
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

quellen

Welche Quellen diesen Datensatz belegen und wann.

nvd osv NVD CVE.org MITRE

veröffentlicht 2026-09-16geändert 2026-09-18

Referenzen (1) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55lMailing ListVendor Advisory

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan