Missing Authorization in Apache ZooKeeper - CVE-2026-79993
Published: September 16, 2026
Vulnerability identifier: #VU150214
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-79993
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to delete empty persistent, container, and TTL znodes regardless of ACL restrictions.
The vulnerability exists due to missing authorization in the deleteContainer opcode when processing a raw deleteContainer protocol request. A remote attacker can open a plain TCP session to the ZooKeeper client port and issue the raw protocol opcode to delete an empty znode.
The deleteContainer request path skips both the session check and the DELETE ACL check.
Affected software
Apache ZooKeeper
IBM SPSS Modeler
IBM Netezza Performance Server
InfoSphere Data Replication
IBM SPSS Modeler
IBM Netezza Performance Server
InfoSphere Data Replication
How to mitigate CVE-2026-79993
Install security update from vendor's website.
Apache ZooKeeper - addressed in versions 3.8.7, 3.9.6
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826