CVE-2026-79993: Apache ZooKeeper Auth Bypass Vulnerability

CVE-2026-79993 Overview

CVE-2026-79993 is an authorization bypass in Apache ZooKeeper. The deleteContainer opcode (0x14/20) processes requests without verifying the caller's Access Control List (ACL) permissions. Any client that can open a plain TCP session to the ZooKeeper client port (2181 by default) can delete empty persistent znodes, container znodes, and TTL znodes without authentication. The deleteContainer code path skips both the session check and the DELETE ACL check enforced by the regular delete opcode (2). The flaw is classified under Missing Authorization [CWE-862] and affects Apache ZooKeeper 3.9.0 through 3.9.5 and 3.8.0 through 3.8.6.

Critical Impact
Unauthenticated attackers with network access to port 2181 can delete arbitrary empty znodes, disrupting configuration data, service discovery, and coordination workflows for any application relying on ZooKeeper.

Affected Products

Apache ZooKeeper 3.9.0 through 3.9.5
Apache ZooKeeper 3.8.0 through 3.8.6
Downstream distributions bundling the affected ZooKeeper versions

Discovery Timeline

2026-09-16 - CVE-2026-79993 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-79993

Vulnerability Analysis

Apache ZooKeeper implements a wire protocol where each request carries a numeric opcode. The regular delete request (opcode 2) invokes ACL enforcement through the checkACL routine and validates the session before mutating the data tree. The deleteContainer opcode (20) is documented as internal-only and is intended to be issued by the server itself when reaping empty container or TTL znodes. Because the opcode was never expected to arrive from external clients, the request handler omits both the session state validation and the DELETE ACL check.

An attacker who can reach the client port can craft raw protocol frames carrying opcode 20 and a target znode path. The server accepts the frame and deletes the znode if it is empty, regardless of the ACLs applied to that node or its parent. Successful deletion affects regular persistent znodes, container nodes, and TTL nodes.

Root Cause

The root cause is missing authorization enforcement on an internal-only opcode exposed on the same TCP listener used by external clients. The deleteContainer request path bypasses the checkACL invocation applied to the standard delete flow, treating any inbound request as if it were server-originated maintenance traffic. See the Apache Mailing List Thread for the maintainer discussion.

Attack Vector

Exploitation requires only TCP reachability to the ZooKeeper client port (2181 by default). The attacker does not need valid credentials, a session, or any ACL grant on the target path. By opening a raw TCP connection and transmitting a well-formed request frame with opcode 20 and the victim znode path, the attacker triggers deletion of any empty persistent, container, or TTL znode. Refer to the Openwall OSS-Security Discussion for protocol-level context.

No verified proof-of-concept code has been published.
See the referenced advisories for protocol details.

Detection Methods for CVE-2026-79993

Indicators of Compromise

Unexpected disappearance of empty persistent, container, or TTL znodes recorded in ZooKeeper audit or transaction logs.
Inbound TCP connections to port 2181 from hosts outside the approved ZooKeeper client inventory.
Application errors reporting NoNodeException for paths that existed before the connection was observed.
ZooKeeper transaction log entries showing deleteContainer operations originating from client session IDs rather than internal maintenance.

Detection Strategies

Enable ZooKeeper audit logging and alert on deleteContainer transactions attributed to external client sessions.
Correlate zxid transaction records with client IP addresses recorded in the server logs to identify unauthorized deletions.
Deploy network sensors on the 2181 client port to flag raw protocol frames issued by hosts not listed in application allowlists.

Monitoring Recommendations

Ship ZooKeeper server logs and transaction logs to a centralized log platform for retention and correlation.
Monitor ensemble health metrics for sudden drops in znode counts under critical paths.
Track ACL denial rates and session churn as baselines, then alert on statistically significant deviations.

How to Mitigate CVE-2026-79993

Immediate Actions Required

Upgrade Apache ZooKeeper to version 3.9.6 or 3.8.7, which enforce ACL checks on the deleteContainer opcode.
Restrict network access to the ZooKeeper client port (2181) using firewalls, security groups, or service mesh policies so only trusted application hosts can connect.
Audit transaction logs for prior deleteContainer activity originating from unauthorized clients and restore any deleted configuration znodes from backups.

Patch Information

Apache has released fixed builds in ZooKeeper 3.9.6 and 3.8.7. The patches add DELETE ACL enforcement and session validation to the deleteContainer request path so that only authorized principals can trigger container reaping. Review the Apache Mailing List Thread for release details.

Workarounds

Bind the ZooKeeper client port to an internal management interface and block external routing to it.
Require mutual TLS between clients and the ZooKeeper ensemble so unauthenticated TCP peers cannot complete the handshake required to send opcode frames.
Segment ZooKeeper ensembles into dedicated VLANs or private subnets, and use jump hosts for administrative access until patches are applied.

bash

# Example iptables rule restricting ZooKeeper client port to trusted subnet
iptables -A INPUT -p tcp --dport 2181 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2181 -j DROP