Apache ZooKeeper Flaws Let Attackers Delete Nodes and Spoof Logs

The Apache Software Foundation has released updates for four Apache ZooKeeper vulnerabilities affecting versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. The flaws could affect distributed coordination clusters used by platforms including Apache Hadoop and Apache Kafka. The vendor reportedly confirmed that there is no known in-the-wild exploitation or public exploit code at present.

CVE-2026-79993 is an authorisation bypass in an undocumented protocol handler. According to the advisory, the `deleteContainer` request path skips session and DELETE ACL checks, allowing an unauthenticated attacker able to reach client port 2181 to delete empty persistent znodes. CVE-2026-59739 can disclose restricted znode names through existence watches registered on non-existent paths during client reconnection, although the article says node data remains protected.

CVE-2026-84439 allows tab characters in digest-authentication requests to inject fields into audit logs, potentially spoofing audit results. CVE-2026-59969 may allow rogue certificates to join quorum traffic when FIPS mode is enabled.

Administrators should upgrade to Apache ZooKeeper 3.8.7 or 3.9.6 using packages from the official release page. The report also recommends restricting access to port 2181 with internal firewalls and reviewing audit logs for unusual tab characters or unauthorised deletion commands.