CVE-2026-59739

highpriority · track · 0OT risk · elevatedEPSS 0.006 · 46 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.55% (46th) EPSS

CVSS 7.5 · high

Is it mine?

4 products

Check your exposure

Who says so?

2 sources

nvd · osv

EPSS · scored 2026-10-28

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-862US

affected products (4)

Products and version ranges known to be affected.

apache zookeeper3.8.0 → 3.8.7nvdUScpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
apache zookeeper3.9.0 → 3.9.6nvdUScpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
Bitnami zookeeper3.8.0 → 3.8.7osvUSpkg:bitnami/zookeeper
Bitnami zookeeper3.9.0 → 3.9.6osvUSpkg:bitnami/zookeeper

advisories (1)

Vendor and ecosystem advisories describing this.

BIT-zookeeper-2026-59739Apache ZooKeeper: Information disclosure via SetWatches reconnect replay2026-09-19vendor · osvUS
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

sources

Which sources assert this record, and when.

nvd osv NVD CVE.org MITRE

published 2026-09-16modified 2026-09-18

references (1) nvd

External citations — patches, advisories, analysis.

https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55lMailing ListVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan