Apache ZooKeeper EUVD-2026-80332

Requires network reachability to the ZooKeeper client port (2181 by default) and the ability to open a raw TCP session and speak the wire protocol directly - the official client exposes no API for the deleteContainer opcode (20), so an attacker must craft the raw request. NO authentication credentials and NO ACL grant are needed; the vulnerable path skips both the session check and the DELETE ACL check. Exploitation is limited to deleting EMPTY persistent, container, and TTL znodes (non-empty nodes are not directly removable), and affected servers must run ZooKeeper 3.8.0-3.8.6 or 3.9.0-3.9.5. The primary real-world limiter is deployment topology: many production ensembles restrict port 2181 to internal application/ensemble networks, so exposure hinges on whether that port is reachable by the attacker.

This is a genuine authorization-bypass with a credible medium-high risk profile, but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description: exploitation needs only a plain TCP session to the ZooKeeper client port (2181) with no authentication and no ACL grant, and the deleteContainer path skips both the session check and the DELETE ACL check that OpCode 2 enforces. Impact is scoped to integrity (I:H, C:N/A:N) because the primitive deletes empty persistent/container/TTL znodes rather than reading data or crashing the service - though cascading deletion of coordination state can indirectly harm dependent systems. EPSS is low (0.24%, 16th percentile), there is NO CISA KEV listing and no public exploit code identified, so despite the low attack complexity this reads as a real-but-not-yet-exploited priority rather than an actively-abused flaw. The key limiting factor CVSS does not capture: exploitation requires network reachability of port 2181, which in well-run deployments is segmented to an internal ensemble/application tier. No signals conflict; the main correction is a taxonomy one - the 'Authentication Bypass' tag understates that this is an authorization/ACL-enforcement bypass (correctly captured by CWE-862).

An attacker who can reach the ZooKeeper client port (2181) opens a raw TCP session without authenticating and, without any ACL grant, issues the internal-only deleteContainer opcode (20) referencing empty persistent, container, or TTL znodes. The request bypasses the session and DELETE ACL checks, silently removing coordination state that dependent systems (e.g. Kafka, Hadoop) rely on. No public proof-of-concept is identified, but the raw-protocol steps are described in enough detail to be readily reproduced.