CVE-2026-79993

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

EUVD-2026-80332

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-79993

Apache ZooKeeper versions 3.9.0–3.9.5 and 3.8.0–3.8.6 are affected by an authorization bypass in the deleteContainer opcode (0x14/20). This opcode is treated as internal-only, yet its request path skips both the session check and the DELETE ACL check enforced by the regular delete path. As a resu...