As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
CVE-2026-79993 is a critical vulnerability in Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 where the deleteContainer opcode lacks access control list (ACL) verification. An authenticated client can delete any empty persistent or container znode without proper authorization checks.
Why it matters: ZooKeeper operators running affected versions face unauthorized data deletion attacks from any authenticated user, potentially disrupting distributed system coordination and requiring immediate patching.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
CVE-2026-79993 is a missing ACL check vulnerability in Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 that allows authenticated clients to delete empty container znodes without proper permissions verification. The deleteContainer opcode processes requests without validating caller ACL permissions, bypassing znode and parent ACL restrictions.
Why it matters: Organizations running ZooKeeper 3.8 or 3.9 must patch immediately; any authenticated user can delete critical znodes, disrupting cluster coordination and availability for applications dependent on ZooKeeper's data tree.
- Source published
- First seen by Cybersecurity Tracker