Apache ZooKeeper 3.8.x < 3.8.7 / 3.9.x < 3.9.6 Multiple Vulnerabilities

high Nessus Plugin ID 347958

Language:

Synopsis

The remote Apache ZooKeeper server is affected by multiple vulnerabilities.

Description

The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.7 or 3.9.x prior to 3.9.6. It is, therefore, affected by multiple vulnerabilities:

- Information disclosure via SetWatches reconnect replay due to a missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. The SetWatches/SetWatches2 reconnect replay handler calls watcher.process(event) with null ACL, bypassing the check in WatchManager.triggerWatch(). Only the path is exposed, not the znode data, but znode paths can contain sensitive information such as usernames or login IDs. (CVE-2026-59739)

- Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows. (CVE-2026-59969)

- The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions. A client that can open a plain TCP session on the ZooKeeper client port, with no authentication and no ACL permissions, can delete any empty persistent znode, including regular persistent nodes, container nodes and TTL nodes, by issuing the raw protocol deleteContainer opcode. The deleteContainer request path skips both the session check and the DELETE ACL check that are enforced by the regular delete path. (CVE-2026-79993)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to Apache ZooKeeper 3.8.7 or 3.9.6 or later.

Plugin Details

Severity: High

ID: 347958

File Name: apache_zookeeper_3_9_6.nasl

Version: 1.3

Type: Combined

Family: Misc.

Published: 9/18/2026

Updated: 9/21/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-59739

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-79993

Vulnerability Information

CPE: cpe:/a:apache:zookeeper

Required KB Items: installed_sw/Apache Zookeeper

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2026

Vulnerability Publication Date: 9/15/2026

Reference Information

CVE: CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, CVE-2026-84501

IAVB: 2026-B-0263

Detections

Analytics