Executive brief
Apache ZooKeeper is a distributed coordination service used to manage configuration and synchronization in distributed systems. An incomplete security fix allows an attacker to discover the names of ACL-restricted data paths by exploiting the SetWatches reconnect replay mechanism. While the actual data stored in these paths remains protected, the path names themselves can expose sensitive information such as usernames or login IDs.
Technical details
The vulnerability is a missing ACL (Access Control List) check in the SetWatches reconnect replay handler. It stems from an incomplete fix to CVE-2024-23944: while the fix added ACL validation to WatchManager.triggerWatch(), the vulnerable DataTree.setWatches() method still calls watcher.process(event) with null ACL context, bypassing the check entirely. An attacker can exploit this by registering exists-watches on non-existent paths, then reconnecting after those paths are created with restricted ACLs—the ZooKeeper server will replay the watch events without proper ACL validation, exposing the path names to the connecting client. The attack requires the ability to connect to ZooKeeper as a client; no data contents are leaked, only the path names. Patches are available in versions 3.9.6 and 3.8.7.
Affected products
- Apache ZooKeeper prior to 3.8.7 and 3.9.6
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patches available in versions 3.8.7 and 3.9.6