ZooKeeper ACL flaws, McEliece analysis, and Airflow provider CVEs

Apache projects dominated the day's security disclosures, with three ZooKeeper CVEs covering ACL bypasses and TLS verification gaps alongside several moderate Airflow provider issues. Post-quantum and OpenPGP discussions added technical depth on attack practicality and previously unreported GnuPG-related flaws.

ZooKeeper SetWatches reconnect exposes ACL-restricted paths

Apache ZooKeeper disclosed CVE-2026-59739, an information disclosure flaw in which incomplete remediation of CVE-2024-23944 lets reconnecting clients replay SetWatches and learn paths that ACLs should hide. The issue affects deployments that rely on fine-grained path ACLs for isolation. Operators should treat the disclosure as a prompt to upgrade and re-audit watch handling after client reconnects.

Classic McEliece quasipolynomial claim assessed as slower than known attacks

A paper presented on the NIST PQC forum claimed a quasipolynomial distinguisher and decryption attack against Classic McEliece. Subsequent analysis by participants concluded the approach remains slower than existing standard attacks under relevant parameter sets. The exchange matters for implementers tracking the concrete security margin of code-based candidates still under consideration.

ZooKeeper deleteContainer opcode skips ACL checks

CVE-2026-79993 reports that ZooKeeper's deleteContainer opcode omitted ACL validation, allowing any client to delete empty persistent or container znodes in versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. Unauthorized deletion of structural nodes can disrupt coordination services that depend on those containers. Fixed releases restore the missing checks.

gpg.fail authors publish retrospective and additional findings

The authors of the gpg.fail research released a retrospective covering the original vulnerabilities plus an unreported remote code execution path in gpgsm and an RSASSA-PSS issue in libgcrypt. The GnuPG maintainer replied on the list regarding exploitability and the status of fixes. The thread supplies context for maintainers and packagers still evaluating residual risk in the OpenPGP stack.

Airflow FAB provider fails to invalidate sessions after password reset

CVE-2026-82311 affects the Apache Airflow FAB provider: password-reset logic never invalidates existing sessions because a string-versus-int comparison on _user_id is always false. An attacker who already holds a session cookie can retain access after a password change. The flaw is limited to environments using the FAB auth provider.

Airflow Kafka provider allows scheduler RCE via connection callbacks

CVE-2026-86792 describes remote code execution on the Airflow scheduler through Kafka connection callback configuration when optional event features are enabled. A user who can edit connections can supply callback code that the scheduler later executes. The issue is rated moderate and requires the optional Kafka event path to be active.

ZooKeeper FIPS-mode quorum TLS skips hostname verification

CVE-2026-59969 covers improper certificate validation with host mismatch when ZooKeeper runs quorum TLS in FIPS mode. The bypass weakens the intended mutual authentication among ensemble members. Fixes appear in 3.8.7 and 3.9.6.

Airflow Keycloak provider leaves tokens unbound to session identity

CVE-2026-76186 reports that Keycloak token cookies in the Apache Airflow Keycloak provider are not bound to the Airflow session identity. A mismatched token and session can produce unexpected authorization outcomes. The disclosure is rated moderate and applies only to deployments that use the Keycloak provider.