CVE-2026-59739 Overview
Apache ZooKeeper contains an information disclosure vulnerability in the SetWatches and SetWatches2 reconnect replay handler. The flaw allows an attacker to discover paths protected by Access Control Lists (ACLs) by registering exists-watches on non-existent znodes, then reconnecting after those paths are created with restricted ACLs. The issue stems from an incomplete fix for CVE-2024-23944 [CWE-862]. Only the znode path is exposed, not its data, but paths can encode sensitive values such as usernames or login identifiers.
Critical Impact
Unauthorized clients can enumerate ACL-restricted znode paths through watch replay, leaking identifiers and organizational structure encoded in path names.
Affected Products
- Apache ZooKeeper versions prior to 3.9.6
- Apache ZooKeeper versions prior to 3.8.7
- Deployments relying on ACLs to protect sensitive path names
Discovery Timeline
- 2026-09-16 - CVE-2026-59739 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-59739
Vulnerability Analysis
Apache ZooKeeper allows clients to register watches on znode paths, including paths that do not yet exist. When a client reconnects, it replays its registered watches to the server through SetWatches or SetWatches2 requests. The server checks whether the watched paths currently exist and fires watch events accordingly. This replay path fails to enforce ACLs, so a client can learn that a previously non-existent path was created — even if the current ACL forbids that client from reading the node.
The original fix for CVE-2024-23944 (tracked as ZOOKEEPER-4799) added ACL checks to WatchManager.triggerWatch(). That fix did not cover the reconnect replay code path.
Root Cause
The reconnect replay handler in DataTree.setWatches() invokes watcher.process(event) with a null ACL argument. Because the ACL is null, the authorization check added in the CVE-2024-23944 remediation is bypassed. The server delivers the watch event to the client regardless of whether that client is authorized to observe the target znode. This is a missing authorization defect [CWE-862] rooted in inconsistent enforcement between the primary watch trigger path and the reconnect replay path.
Attack Vector
An authenticated or unauthenticated client with network access to the ZooKeeper ensemble registers exists-watches on candidate paths that do not yet exist. The client then disconnects. When another actor later creates those paths with restrictive ACLs, the attacker reconnects and replays the watch set via SetWatches/SetWatches2. The server fires watch events for any paths that now exist, confirming their presence to the attacker without evaluating ACLs. Because ZooKeeper is often used to store service registrations, session identifiers, or account references in path names, disclosure of paths alone can leak sensitive information.
See the Apache Mailing List Discussion for the maintainer analysis.
Detection Methods for CVE-2026-59739
Indicators of Compromise
- Clients issuing repeated SetWatches or SetWatches2 requests immediately after reconnect, containing large sets of speculative paths
- Watch registrations on non-existent paths from clients that lack read authority for the parent hierarchy
- Anomalous reconnect frequency from a single client identity or source address
Detection Strategies
- Audit ZooKeeper server logs for SetWatches/SetWatches2 operations and correlate the paths supplied with the requesting client's authenticated principal and ACL grants
- Alert on clients that register watches on many paths they cannot read, especially where paths encode user or account identifiers
- Baseline normal watch counts per client and flag deviations
Monitoring Recommendations
- Enable ZooKeeper audit logging and forward events to a centralized analytics platform for retention and correlation
- Monitor for reconnect storms from external or untrusted network segments reaching client ports (default 2181)
- Track watch-registration metrics exposed through the ZooKeeper Admin Server and JMX for sudden increases
How to Mitigate CVE-2026-59739
Immediate Actions Required
- Upgrade Apache ZooKeeper to version 3.9.6 or 3.8.7, which contain the corrected ACL check in the reconnect replay path
- Restrict network access to ZooKeeper client and quorum ports so that only trusted application tiers can connect
- Review znode naming conventions and remove sensitive identifiers such as usernames or login IDs from path components
Patch Information
The Apache ZooKeeper maintainers fixed the issue in versions 3.9.6 and 3.8.7. The patch extends ACL enforcement to DataTree.setWatches() so that SetWatches and SetWatches2 reconnect replays no longer deliver watch events with a null ACL. Refer to the Apache Mailing List Discussion for the official announcement.
Workarounds
- Enforce SASL authentication and require authenticated principals for all client sessions
- Redesign znode hierarchies so that sensitive attributes are stored only in node data, never in path segments
- Use network segmentation and firewall rules to limit which hosts can open sessions to the ensemble until upgrades are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
