CVE-2026-59739: apache zookeeper

csirt@kutim:~/threat-intel/cve/CVE-2026-59739

CVSS 7.5 · High EPSS 0,55%

Kerentanan Missing Authorization pada apache zookeeper. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

Rincian

Terbit di NVD: 16 September 2026
Terakhir diubah: 18 September 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,55% peluang dieksploitasi; lebih tinggi dari 44,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	zookeeper	Versi 3.8.0 hingga sebelum 3.8.7
apache	zookeeper	Versi 3.9.0 hingga sebelum 3.9.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l mailing list · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.