CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.

• CWE-862

• https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55lMailing List, Vendor Advisory

Published

Sep 16, 2026

Last Modified

Sep 18, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5973A vulnerability was found in FoundationAgents MetaGPT up to …9.8
• CVE-2026-59730Astro is a web framework for content-driven websites. In ver…2.1
• CVE-2026-59731Astro is a web framework for content-driven websites. Versio…8.2
• CVE-2026-59732Rclone is a command-line program to sync files and directori…5
• CVE-2026-59733Rclone is a command-line program to sync files and directori…8.8
• CVE-2026-59734Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-5974A vulnerability was determined in FoundationAgents MetaGPT u…9.8
• CVE-2026-5975A vulnerability was identified in Totolink A7100RU 7.4cu.231…9.8
• CVE-2026-5976A security flaw has been discovered in Totolink A7100RU 7.4c…9.8
• CVE-2026-59762When an HTTP/2 profile is configured on a virtual server, un…8.7
• CVE-2026-59763Unbounded Arch package file metadata can cause resource ampl…4.3
• CVE-2026-59764ELECOM wireless LAN routers and access points devices contai…8.6