ZooKeeper ACL bypass lets anyone delete empty znodes
CVE-2026-79993 skips auth and permission checks on the internal deleteContainer opcode in 3.8 and 3.9 releases.
Apache ZooKeeper has a critical authorization bypass that lets an unauthenticated client delete empty persistent znodes simply by speaking the wire protocol on the client port.
CVE-2026-79993 is a missing ACL check on the deleteContainer opcode. That path is treated as internal-only and is not exposed by the official client API, yet it skips both the session check and the DELETE ACL enforcement that the normal delete path applies. Any client that can open a plain TCP session to the ZooKeeper client port (2181 by default), with no authentication and no ACL rights, can issue the raw opcode and remove any empty persistent node, container node, or TTL node, regardless of ACLs on the node or its parent.
The issue affects ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. Fixed releases are 3.8.7 and 3.9.6. Operators who expose the client port should upgrade.