CVE-2024-23944
published 2024-03-15CVE-2024-23944: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching…
PriorityP424medium5.3CVSS 3.1
AVLACLPRLUINSUCLILAL
EPSS
0.25%
15.1th percentile
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zookeeper | — | — |
| apache | zookeeper | >= 0 < 3.8.0-11+deb12u2 | 3.8.0-11+deb12u2 |
| apache | zookeeper | >= 0 < 3.9.2-1 | 3.9.2-1 |
| apache | zookeeper | >= 0 < 3.9.2-1 | 3.9.2-1 |
| apache | zookeeper | 3.6.0 – 3.7.2 | — |
| apache | zookeeper | >= 3.8.0 < 3.8.4 | 3.8.4 |
| apache | zookeeper | >= 3.8.0 < 3.8.7 | 3.8.7 |
| apache | zookeeper | >= 3.9.0 < 3.9.2 | 3.9.2 |
| apache | zookeeper | >= 3.9.0 < 3.9.6 | 3.9.6 |
| apache_software_foundation | apache_zookeeper | 3.8.0 – 3.8.6 | — |
| apache_software_foundation | apache_zookeeper | 3.9.0 – 3.9.5 | — |
| debian | zookeeper | < zookeeper 3.8.0-11+deb12u2 (bookworm) | zookeeper 3.8.0-11+deb12u2 (bookworm) |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| rhoai | odh-modelmesh-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check.
ghsa_unreviewed·2026-09-16·CVSS 5.3
CVE-2026-59739 [MEDIUM] CWE-862 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check.
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recomm
OSV
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
osv·2024-03-15
CVE-2024-23944 [MEDIUM] Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to
OSV
CVE-2024-23944: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check
osv·2024-03-15·CVSS 5.3
CVE-2024-23944 [MEDIUM] CVE-2024-23944: Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
GHSA
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
ghsa·2024-03-15
CVE-2024-23944 [MEDIUM] CWE-200 Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to
Red Hat
zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
vendor_redhat·2026-09-16·CVSS 5.3
CVE-2026-59739 [MEDIUM] CWE-425 zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive informat
Oracle
Oracle Oracle GoldenGate Risk Matrix: Spark (Apache ZooKeeper) — CVE-2024-23944
vendor_oracle·2024-10-15·CVSS 5.3
CVE-2024-23944 [MEDIUM] Oracle Oracle GoldenGate Risk Matrix: Spark (Apache ZooKeeper) — CVE-2024-23944
Oracle Oracle GoldenGate Risk Matrix: Spark (Apache ZooKeeper) vulnerability
CVE: CVE-2024-23944
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache ZooKeeper) — CVE-2024-23944
vendor_oracle·2024-07-15·CVSS 3.1
CVE-2024-23944 [MEDIUM] Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache ZooKeeper) — CVE-2024-23944
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache ZooKeeper) vulnerability
CVE: CVE-2024-23944
CVSS: 3.1
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Red Hat
Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
vendor_redhat·2024-03-15·CVSS 5.3
CVE-2024-23944 [MEDIUM] CWE-200 Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade
Debian
CVE-2024-23944: zookeeper - Information disclosure in persistent watchers handling in Apache ZooKeeper due t...
vendor_debian·2024·CVSS 5.3
CVE-2024-23944 [MEDIUM] CVE-2024-23944: zookeeper - Information disclosure in persistent watchers handling in Apache ZooKeeper due t...
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical. Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.
Scope: local
bookworm: resolved (fixed in 3.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59739 golang-github-samuel-zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [fedora-all]
bugzilla·2026-09-28·CVSS 5.3
CVE-2026-59739 [MEDIUM] CVE-2026-59739 golang-github-samuel-zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [fedora-all]
CVE-2026-59739 golang-github-samuel-zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWat
Bugzilla
CVE-2026-59739 golang-github-zookeeper-zk: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [epel-all]
bugzilla·2026-09-28·CVSS 5.3
CVE-2026-59739 [MEDIUM] CVE-2026-59739 golang-github-zookeeper-zk: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [epel-all]
CVE-2026-59739 golang-github-zookeeper-zk: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/S
Bugzilla
CVE-2026-59739 golang-github-zookeeper-zk: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [fedora-all]
bugzilla·2026-09-28·CVSS 5.3
CVE-2026-59739 [MEDIUM] CVE-2026-59739 golang-github-zookeeper-zk: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [fedora-all]
CVE-2026-59739 golang-github-zookeeper-zk: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches
Bugzilla
CVE-2026-59739 zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
bugzilla·2026-09-16·CVSS 5.3
CVE-2026-59739 [MEDIUM] CVE-2026-59739 zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739 zookeeper: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sen
Bugzilla
CVE-2024-23944 Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
bugzilla·2024-11-25·CVSS 5.3
CVE-2024-23944 [MEDIUM] CVE-2024-23944 Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
CVE-2024-23944 Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling
Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recomme
2024-03-15
Published