CVE-2026-79993 Apache Software Foundation CVE debrief

Who should care

ZooKeeper administrators and users with znodes requiring ACL protection, as well as security teams and operators managing ZooKeeper deployments. These stakeholders should be aware of the potential for unauthorized deletion of znodes and take steps to verify ACL configurations and upgrade to fixed versions.

Why it matters

CVE-2026-79993 allows authenticated clients to bypass ACL restrictions and delete znodes in Apache ZooKeeper. Users should upgrade to fixed versions and verify ACL configurations to prevent unauthorized deletions.

• Potential unauthorized deletion of znodes
• Bypass of ACL restrictions on znodes
• Possible disruption of dependent applications
• Need for verification of ACL configurations and ZooKeeper versions

Technical summary

The `deleteContainer` opcode in Apache ZooKeeper is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of ACL restrictions on the znode or its parent. The opcode is internal-only and not part of the official client API. However, a client with a plain TCP session on the ZooKeeper client port and no authentication or ACL permissions can delete empty persistent znodes. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.

Defensive priority

Upgrade to fixed versions; verify ACL configurations

Recommended defensive actions

• Upgrade to Apache ZooKeeper version 3.9.6 or 3.8.7
• Verify and restrict ACL configurations for znodes
• Monitor for unauthorized deletion attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected versions. The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions. This opcode is considered internal-only and the official client doesn't have API for it. A client that can open a plain TCP session on the ZooKeeper client port (2181 by default) with NO authentication and NO ACL permissions can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.