Apache ZooKeeper CVE-2026-59739

Requires a running Apache ZooKeeper 3.8.0-3.8.6 or 3.9.0-3.9.5 server whose client port is network-reachable by the attacker, and the ability to establish a client session and issue SetWatches/SetWatches2 on reconnect (default protocol behavior, no authentication needed per PR:N). The attacker must register exists-watches on paths BEFORE they are created and then reconnect AFTER a privileged process creates them under a restricted ACL - so success depends on correctly anticipating (guessing) target path names and on those paths carrying sensitive information (usernames, login IDs) to be of value. Limiting factors: only path existence is revealed, never znode data; exploitation is probabilistic (depends on path-name prediction and reconnect timing); and impact is meaningful only when deployments encode secrets in znode path names rather than in data.

The signals converge on a genuine but modest-severity information-disclosure issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) indicates network-reachable, unauthenticated, low-complexity access with high confidentiality impact and no integrity/availability effect. However, the vendor's C:H rating appears aggressive relative to the described impact: the flaw leaks only the EXISTENCE of a znode PATH (never its data), and exploitation requires the attacker to pre-register exists-watches on speculative paths and time a reconnect after those paths are created - a probabilistic, guessing-and-timing element the AC:L does not fully capture. A C:L rating (my assessed ~5.3) better reflects that only path metadata is disclosed. EPSS is low (0.20%, 10th percentile), there is no CISA KEV listing and no public exploit - consistent with a subtle logic bug that is hard to weaponize opportunistically. Exploitation status: no public exploit identified at time of analysis. Note the metadata conflict: the 'Authentication Bypass' tag mischaracterizes this as an authn flaw when the description and CWE-862 make clear it is an authorization/ACL-enforcement bypass. Overall this is a real but lower-priority fix - significant mainly where znode paths embed sensitive tokens (usernames, login IDs).

An attacker connects to the ZooKeeper client port and registers exists-watches on guessed, currently non-existent paths that a privileged process is expected to create later under a restricted ACL. After the legitimate application creates those ACL-protected znodes, the attacker triggers a session reconnect; the SetWatches/SetWatches2 replay handler in DataTree.setWatches() fires the watch with a null ACL, confirming the path now exists and leaking any sensitive information encoded in the path name. No public exploit code exists, but the network-reachable, unauthenticated vector (AV:N/PR:N) makes it straightforward for anyone with client-port access.