As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 contain a critical information disclosure vulnerability (CVE-2026-59739) in which missing ACL checks allow attackers to discover access control-restricted paths. An attacker can register exists-watches on non-existent paths and then reconnect after those paths are created to gain unauthorized visibility into sensitive configuration data.
Why it matters: Organizations operating Apache ZooKeeper in coordination or configuration management roles face exposure of ACL-protected data; immediate patching of affected versions is required to prevent attackers from discovering restricted cluster metadata.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739 is an information disclosure vulnerability in Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5, caused by missing access control list (ACL) checks during SetWatches reconnect replay. An attacker can exploit this by registering watches on non-existent paths and reconnecting after those paths are created to discover ACL-restricted information.
Why it matters: ZooKeeper operators managing these versions face exposure of sensitive path data that should be access-controlled; assess whether your deployments match the affected versions and update to patch available fixes.
- Source published
- First seen by Cybersecurity Tracker