CVE-2026-79993: CWE-862 Missing Authorization in Apache Software Foundation Apache ZooKeeper
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.
AI Analysis
Technical Summary
Apache ZooKeeper contains a missing authorization vulnerability (CWE-862) in the handling of the deleteContainer opcode (0x14/20). This opcode is intended for internal use and is not exposed via the official client API. However, a client capable of opening a plain TCP session to the ZooKeeper client port (default 2181) can issue a raw deleteContainer request to delete any empty persistent znode, including regular persistent nodes, container nodes, and TTL nodes, without any ACL or session validation. This bypasses the normal ACL enforcement applied to the standard delete opcode (0x2). The vulnerability affects Apache ZooKeeper versions from 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. The issue is resolved in versions 3.8.7 and 3.9.6.
Potential Impact
An attacker with network access to the ZooKeeper client port can delete empty persistent znodes without any authentication or authorization checks. This can lead to unauthorized deletion of data nodes in the ZooKeeper data tree, potentially disrupting applications relying on ZooKeeper for coordination and configuration management. The vulnerability bypasses ACL restrictions and session validation, undermining the integrity of the ZooKeeper data.
Mitigation Recommendations
Users should upgrade Apache ZooKeeper to version 3.8.7 or 3.9.6, where this vulnerability has been fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating fixed versions.
CVE-2026-79993: CWE-862 Missing Authorization in Apache Software Foundation Apache ZooKeeper
Description
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.
Affected software
Apache Software Foundation
Apache ZooKeeper
pkg:maven/Apache Software Foundation/org.apache.zookeeper:zookeeperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache ZooKeeper contains a missing authorization vulnerability (CWE-862) in the handling of the deleteContainer opcode (0x14/20). This opcode is intended for internal use and is not exposed via the official client API. However, a client capable of opening a plain TCP session to the ZooKeeper client port (default 2181) can issue a raw deleteContainer request to delete any empty persistent znode, including regular persistent nodes, container nodes, and TTL nodes, without any ACL or session validation. This bypasses the normal ACL enforcement applied to the standard delete opcode (0x2). The vulnerability affects Apache ZooKeeper versions from 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. The issue is resolved in versions 3.8.7 and 3.9.6.
Potential Impact
An attacker with network access to the ZooKeeper client port can delete empty persistent znodes without any authentication or authorization checks. This can lead to unauthorized deletion of data nodes in the ZooKeeper data tree, potentially disrupting applications relying on ZooKeeper for coordination and configuration management. The vulnerability bypasses ACL restrictions and session validation, undermining the integrity of the ZooKeeper data.
Mitigation Recommendations
Users should upgrade Apache ZooKeeper to version 3.8.7 or 3.9.6, where this vulnerability has been fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating fixed versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-25T16:40:35.796Z
- State
- PUBLISHED
Threat ID: 6aaa659d55bf5e2cf5501beb
Added to database: 09/16/2026, 09:47:09 UTC
Last enriched: 09/16/2026, 10:01:41 UTC
Last updated: 09/16/2026, 10:32:25 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.