Executive brief
Apache ZooKeeper is a distributed coordination service used to manage configuration and state in distributed systems. An authentication and access control flaw allows any authenticated client to delete arbitrary data nodes (znodes) without proper permission checks, potentially corrupting the distributed system's state or disrupting dependent applications that rely on this data.
Technical details
The vulnerability is an authorization bypass (ACL enforcement bug) in the deleteContainer opcode (0x14/20) processing. The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. An authenticated client opening a plain TCP session on the ZooKeeper client port (default 2181) can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) regardless of ACL restrictions. The opcode is internal-only and not exposed in the official client API, but direct protocol manipulation allows exploitation. The fix is available in versions 3.9.6 and 3.8.7.
Affected products
- Apache ZooKeeper 3.9.0 through 3.9.5, 3.8.0 through 3.8.6
Timeline
- 2026-09-16: disclosed: CVE-2026-79993 published
- patched: Fixed in version 3.9.6 and 3.8.7