CVE-2026-59739 Apache Software Foundation CVE debrief

Who should care

ZooKeeper administrators and security teams should assess exposure and prioritize upgrading to a fixed version. Deployment contexts where sensitive path information could be at risk require immediate attention.

Why it matters

CVE-2026-59739 is a high-severity vulnerability in Apache ZooKeeper that allows information disclosure via SetWatches reconnect replay. It exposes ACL-restricted paths, potentially containing sensitive information like user names or login IDs. Defenders should assess exposure, especially in sensitive deployment contexts, and prioritize upgrading to version 3.9.6 or 3.8.7. Evidence is based on official CVE and NVD records, as well as a vendor advisory.

• Path exposure in sensitive contexts could lead to unauthorized access or lateral movement
• Potential for sensitive information disclosure through path names
• Requires verification of current ACL configurations and inventory checks for exposure
• Upgrade and remediation priority is high due to potential critical impact

Technical summary

The vulnerability in Apache ZooKeeper is due to an incomplete fix for CVE-2024-23944. The SetWatches/SetWatches2 reconnect replay handler, DataTree.setWatches(), calls watcher.process(event) with a null ACL, bypassing ACL checks entirely. This allows an attacker to discover ACL-restricted paths by registering exists-watches on non-existent paths and reconnecting after the paths are created with restricted ACLs.

Defensive priority

Upgrade to version 3.9.6 or 3.8.7 to fix the issue. Assess exposure in ZooKeeper deployments, especially where sensitive path information could be at risk.

Recommended defensive actions

• Upgrade Apache ZooKeeper to version 3.9.6 or 3.8.7
• Assess exposure in ZooKeeper deployments, especially where sensitive path information could be at risk
• Review and adjust ACL configurations for sensitive paths
• Verify current ACL configurations for potential exposure
• Conduct inventory checks for systems that may be affected
• Monitor for suspicious activity related to path exposure
• Review change management processes for ZooKeeper updates

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and recommended actions. Vendor advisory from Apache is available via a mailing list. Evidence is based on official CVE and NVD records, as well as a vendor advisory. Defenders should verify current ACL configurations, inventory checks for exposure, and assess the potential impact of path exposure in sensitive contexts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.