CVE-2026-79993— Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
Quick assessment
Affected
Apache Software Foundation Apache ZooKeeper
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
The opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-onl
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79993
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
Source: CVE Program / CVE List V5
Vulnerability Description
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper | 3.9.0 ~ 3.9.5 | - |
|
II. Public POCs for CVE-2026-79993
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79993
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-09-16 · 13 CVEs total
| CVE-2026-84501 | Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationP | |
| CVE-2026-84439 | Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources | |
| CVE-2026-59969 | Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode | |
| CVE-2026-59739 | Apache ZooKeeper: Information disclosure via SetWatches reconnect replay | |
| CVE-2026-86466 | Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validate | |
| CVE-2026-76187 | Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session J | |
| CVE-2026-76186 | Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session iden | |
| CVE-2026-82310 | Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API | |
| CVE-2026-86792 | Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Sched | |
| CVE-2026-86462 | Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed | |
| CVE-2026-82311 | Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _us | |
| CVE-2026-86465 | Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via us |
IV. Related Vulnerabilities
Same product: Apache ZooKeeper
-
CVE-2026-84501
Apache ZooKeeper: Operational log forgery via newline inject -
CVE-2026-84439
Apache ZooKeeper: Audit log injection via unsanitized output -
CVE-2026-59969
Apache ZooKeeper: Improper validation of certificate with ho -
CVE-2026-59739
Apache ZooKeeper: Information disclosure via SetWatches reco -
CVE-2026-24308
Apache ZooKeeper: Sensitive information disclosure in client
Same vendor: Apache Software Foundation
-
CVE-2026-84501
Apache ZooKeeper: Operational log forgery via newline inject -
CVE-2026-84439
Apache ZooKeeper: Audit log injection via unsanitized output -
CVE-2026-59969
Apache ZooKeeper: Improper validation of certificate with ho -
CVE-2026-59739
Apache ZooKeeper: Information disclosure via SetWatches reco -
CVE-2026-86466
Apache Airflow FAB provider: FAB Authentik provider: id_toke
Same weakness: CWE-862
-
CVE-2026-92463
yshop-crm through 2.1.3 Missing Authorization via Disabled A -
CVE-2026-92462
yshop-crm through 2.1.3 Missing Authorization via CrmFlowCon -
CVE-2026-92461
yshop-crm through 2.1.3 Missing Authorization via CRM Approv -
CVE-2026-92460
yshop-crm through 2.1.3 Missing Authorization via CRM Operat -
CVE-2026-92459
yshop-crm through 2.1.3 Missing Authorization via CRM Lead-C
V. Comments for CVE-2026-79993
No comments yet