CVE catalog

CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths,

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 25, 2026

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzookeepersid3.9.6-2fixed
Debianzookeeperforky3.9.6-2fixed
Debianzookeepertrixie3.9.3-1+deb13u1vulnerable
Debianzookeeperbookworm3.8.0-11+deb12u2vulnerable
Debianzookeeperbookworm-security3.8.0-11+deb12u1vulnerable
CpezookeeperNot reported3.9.6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzookeepersourcesid3.9.6-1not yet assignedNot reportedNot reported
Debianzookeepersourceforky3.9.6-1not yet assignedNot reportedNot reported
Debianzookeepersourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianzookeepersourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpezookeepercpeNot reported3.9.6Not reportedNVD-CVE-2026-59739Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libzookeeper-java]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [libzookeeper-java-doc]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [libzookeeper-mt2]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · amd64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · arm64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [libzookeeper-mt-dev]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · amd64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · arm64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [libzookeeper-st2]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · amd64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · arm64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [libzookeeper-st-dev]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · amd64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · arm64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [python3-zookeeper]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · amd64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · arm64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [zookeeper]Affected
    Details (4)

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [zookeeper-bin]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · amd64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · arm64 · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

  • [zookeeperd]Affected

    Source package: [zookeeper]

    Details (4)

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u2 · all · bookworm

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

    • 3.8.0-11+deb12u1 · all · bookworm-security

      Affected

      nvd · zookeeper · debian · bookworm; nvd · zookeeper · debian · 12

[Debian 13 (Trixie)]

  • [libzookeeper-java]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [libzookeeper-java-doc]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [libzookeeper-mt2]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · amd64 · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · arm64 · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [libzookeeper-mt-dev]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · amd64 · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · arm64 · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [libzookeeper-st2]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · amd64 · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · arm64 · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [libzookeeper-st-dev]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · amd64 · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · arm64 · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [python3-zookeeper]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · amd64 · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · arm64 · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [zookeeper]Affected
    Details (2)

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [zookeeper-bin]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · amd64 · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · arm64 · trixie

      Affected

      nvd · zookeeper · debian · 13

  • [zookeeperd]Affected

    Source package: [zookeeper]

    Details (2)

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

    • 3.9.3-1+deb13u1 · all · trixie

      Affected

      nvd · zookeeper · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]