CVE-2026-59739

A flaw was found in Apache ZooKeeper. This vulnerability allows a remote attacker to discover paths that should be restricted by Access Control Lists ACLs. By registering watches on non-existent paths and then reconnecting after these paths are created with restricted ACLs, the attacker can bypas...

BIT-ZOOKEEPER-2026-84501 Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

BIT-ZOOKEEPER-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

BIT-ZOOKEEPER-2026-79993 Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

BIT-ZOOKEEPER-2026-59969 Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

BIT-ZOOKEEPER-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

PT-2026-95845

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

PT-2026-95847

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add auth"ensemble", ... request containing newline characters . When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

PT-2026-95846

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters t embedded in the username. Because the audit log uses tab-separated key=value format...

PT-2026-95844

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CLEANSTART-2026-CB66472 Security fix for CVE-2026-22801 applied in: apache-zookeeper 3.7.2-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZH25873 Security fix for CVE-2026-22695 applied in: apache-zookeeper 3.7.2-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CD76162 Security fix for CVE-2025-13151 applied in: apache-zookeeper 3.7.2-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BZ08231 Security fix for CVE-2026-6790 applied in: apache-hive 4.0.1-r8, apache-nifi 2.10.0-r3, apache-zookeeper 3.9.5-r8, cassandra-reaper-fips 3.8.0-r9, cassandra-reaper-fips 4.0.2-r3, cassandra-reaper-fips 4.1.1-r1, solr 10.0.0-r6, strimzi-kafka-operator 1.1.0-r2, trino 480-r10, trino 483-r1

CVE-2026-6790 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EX11941 Security fix for CVE-2026-62243 applied in: apache-zookeeper 3.8.6-r6, apache-zookeeper 3.9.5-r6, elasticsearch 9.5.2-r2, keycloak 26.5.7-r8, solr 10.0.0-r8, solr 9.10.1-r8, solr 9.8.1-r3, trino 480-r11

CVE-2026-62243 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KJ79490 Security fix for CVE-2026-19032 applied in: apache-zookeeper 3.9.5-r7, elasticsearch 9.5.2-r2, solr 10.0.0-r8, solr 9.10.1-r8, solr 9.8.1-r3, trino 480-r12, wso2is 7.0.0-r1, wso2is 7.1.0-r1, wso2is 7.2.0-r2, wso2is 7.3.0-r5

CVE-2026-19032 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-100242

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102227

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100255

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

Apache ZooKeeper 3.8.x < 3.8.7 / 3.9.x < 3.9.6 Multiple Vulnerabilities

The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.7 or 3.9.x prior to 3.9.6. It is, therefore, affected by multiple vulnerabilities: - Information disclosure via SetWatches reconnect replay due to a missing ACL check. An attacker can discover ACL-restricted paths ...