CVE-2026-79993: Apache ZooKeeper Unauthorized Deletion of Znodes Due to Missing ACL Check
Summary
CVE-2026-79993: The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the zno... Affects zookeeper across 2 version ranges.
>= 3.8.0, < 3.8.7
>= 3.9.0, < 3.9.6
Fixed in 3.8.7 or 3.9.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. It is widely used in distributed applications to manage large sets of data across clusters. The service relies on a hierarchical namespace and uses Access Control Lists (ACLs) to manage permissions for various operations. However, certain versions of ZooKeeper are vulnerable to unauthorized deletions due to a flaw in the handling of the deleteContainer opcode.
Vulnerability Detail
The vulnerability arises from the deleteContainer opcode (0x14/20), which processes requests without verifying the caller's ACL permissions. This oversight allows any authenticated client to delete specific znodes in the data tree, bypassing ACL restrictions. The opcode is intended for internal use and lacks an official API in the client. However, clients can exploit this vulnerability by connecting to the ZooKeeper client port (2181 by default) without authentication or ACL permissions, enabling them to delete any empty persistent znode. This creates a significant security risk, as unauthorized deletions can disrupt the integrity of the data tree.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.8.0, < 3.8.73.8.7 -
>= 3.9.0, < 3.9.63.9.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the ZooKeeper client port (2181) by implementing firewall rules or network policies that limit connections to trusted clients only. This will help mitigate the risk of unauthorized access until the software can be updated.
Conclusion
In summary, CVE-2026-79993 is a critical vulnerability in Apache ZooKeeper that allows unauthorized deletion of znodes due to missing ACL checks on the deleteContainer opcode. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the integrity of their data.
See every vulnerability recorded for zookeeper →
FAQ
The vulnerability affects Apache ZooKeeper versions from 3.8.0 through 3.8.6 and from 3.9.0 through 3.9.5.
The vulnerability has a CVSS score of 6.5, which is classified as High severity.
Yes, an attacker can exploit this vulnerability remotely by connecting to the ZooKeeper client port without authentication.
No, the deleteContainer opcode is considered internal-only and does not have an official API in the ZooKeeper client.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for zookeeper.
