Threats tagged 'ghsa-wrgg-c9rw-j78f'

CVE-2026-59739 is an information disclosure vulnerability in Apache ZooKeeper caused by a missing ACL check during SetWatches reconnect replay. An attacker can discover paths protected by ACLs by registering watches on non-existent paths and reconnecting after those paths are created with restricted ACLs. The vulnerability exposes the znode path but not its data. Since paths may contain sensitive information such as usernames or login IDs, this issue is potentially critical. The vulnerability affects multiple versions prior to 3.8.7 and 3.9.6. Upgrading to versions 3.8.7 or 3.9.6 resolves the issue.