Missing Authorization in Apache ZooKeeper - CVE-2026-59739
Published: September 16, 2026
Vulnerability identifier: #VU150217
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59739
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose ACL-restricted znode paths.
The vulnerability exists due to a missing authorization check in the DataTree.setWatches() SetWatches/SetWatches2 reconnect replay handler when replaying registered exists-watches after a client reconnects. A remote attacker can register exists-watches on non-existent paths and reconnect after the paths are created with restricted ACLs to disclose ACL-restricted znode paths.
Only znode paths are exposed; znode data is not exposed.
Affected software
Apache ZooKeeper
IBM SPSS Modeler
IBM Netezza Performance Server
InfoSphere Data Replication
IBM SPSS Modeler
IBM Netezza Performance Server
InfoSphere Data Replication
How to mitigate CVE-2026-59739
Install security update from vendor's website.
Apache ZooKeeper - addressed in versions 3.8.7, 3.9.6
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826