This vulnerability arises because the DataTree.setWatches() method, which handles SetWatches/SetWatches2 reconnect replay, calls watcher.process(event) without enforcing ACL checks, bypassing the intended access control. Although the WatchManager.triggerWatch() method was fixed to include ACL verification, the reconnect replay handler still allows an attacker to infer the existence of ACL-restricted paths by observing watch events on paths that were non-existent at watch registration but later created with restricted ACLs. The exposure is limited to path names, not the znode data itself.

An unauthenticated attacker can discover the existence of ACL-restricted znode paths in Apache ZooKeeper by exploiting the missing ACL check during watch reconnect replay. While the actual data of the znodes remains protected, the disclosure of path names can leak sensitive information such as usernames or login IDs embedded in the path, which may aid further reconnaissance or targeted attacks.

A fix is available in Apache ZooKeeper versions 3.9.6 and 3.8.7. Users should upgrade to these versions to remediate the vulnerability. No additional mitigation actions are indicated by the vendor advisory.