ZooKeeper critical bug leaks ACL-restricted paths on reconnect

Apache ZooKeeper has disclosed CVE-2026-59739, a critical information-disclosure flaw that lets an attacker learn the existence of paths protected by ACLs. The bug affects ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5.

An attacker can register exists-watches on paths that do not yet exist, then reconnect after those paths are created under restricted ACLs. On reconnect, the server replays watches without applying the ACL check, so the client learns that the restricted path now exists. Only the path is exposed, not znode data, but paths often embed usernames, login IDs, or other sensitive identifiers, which is why the project rated the issue critical.

The problem is an incomplete remediation of CVE-2024-23944. ACL checking was added for ordinary watch delivery, but the SetWatches reconnect replay path still fired events without that check.

Operators should upgrade to ZooKeeper 3.8.7 or 3.9.6. The issue was reported by NGUYEN HONG QUAN and n0mi1k.