Do Son 
The Apache Software Foundation released security updates, fixing four Apache ZooKeeper vulnerabilities. These flaws include critical authorization bypasses and sensitive data disclosures across distributed coordination clusters. Consequently, unauthenticated attackers can delete critical nodes, falsify audit logs, or join TLS quorum replication streams. Administrators should deploy the latest patches immediately to safeguard enterprise cluster configurations.
Track every Apache CVE the moment it's exploited.
Get free email alertsWhy This Matters
Industry estimates show that tens of thousands of distributed systems rely on ZooKeeper for centralized service synchronization. Major big data platforms, including Apache Hadoop and Apache Kafka, depend on ZooKeeper to manage cluster state. Therefore, security defects in this coordination service threaten entire cloud data centers. If threat actors exploit these Apache ZooKeeper vulnerabilities, they can disrupt critical application pipelines. Furthermore, attackers can tamper with system state and erase evidence from forensic logging engines.
How the Attacks Work
The most severe defect, CVE-2026-79993. Specifically, an authorization bypass exists within an undocumented protocol handler. The advisory notes that “the deleteContainer request path completely skips both the session check and the DELETE ACL check.” An unauthenticated attacker on client port 2181 can issue raw opcode requests to delete empty persistent znodes.
Another critical flaw, CVE-2026-59739, enables information disclosure during client reconnection. This flaw stems from an incomplete previous patch in the watch management subsystem. Attackers register existence watches on non-existent paths to discover restricted znode names. Although node data remains protected, exposed paths often reveal sensitive usernames and internal identifiers.
Additionally, CVE-2026-84439 allows audit log injection through unsanitized tab characters in digest authentication requests. The advisory warns, “the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results.” Finally, CVE-2026-59969 permits rogue certificates to join quorum traffic when FIPS mode is active.
Affected Versions
These security flaws impact Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. The vendor confirmed that no active in-the-wild exploitation or public exploit code currently exists.
Patch and Mitigation Steps
Administrators must update their clusters to Apache ZooKeeper versions 3.8.7 or 3.9.6. You can obtain the fixed packages directly from the official Apache ZooKeeper releases page. Moreover, administrators should restrict network access to port 2181 using trusted internal firewalls. Security teams should also review audit logs for anomalous tab characters or unauthorized deletion commands.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
