Apache ZooKeeper is vulnerable to an unauthenticated information disclosure flaw that allows attackers to discover restricted znode paths, potentially exposing sensitive metadata.

The vulnerability involves a failure to perform authorization checks within the SetWatches reconnect replay handler, which bypasses existing security controls. An unauthenticated attacker can exploit this by registering watches on non-existent paths to gain visibility into restricted znode structures once they are created.

This flaw carries a CVSS score of 7.5, indicating a high severity risk. While the vulnerability does not directly expose the contents of znodes, the disclosure of znode paths can reveal sensitive information such as usernames, login IDs, or internal service topology. This unauthorized reconnaissance can facilitate further targeted attacks against the infrastructure, leading to potential data compromise or systemic instability.

Immediate Action: Upgrade Apache ZooKeeper to version 3.9.6 or 3.8.7, which contain the necessary logic to enforce ACL checks during the reconnect replay process.

Proactive Monitoring: Monitor ZooKeeper access logs for unusual patterns of watch registration or high-frequency reconnect attempts from unknown or unauthorized clients.

Compensating Controls: Restrict network access to the ZooKeeper client port to trusted IP addresses only, and implement mTLS for client authentication to minimize the risk of unauthenticated interaction.

Public Exploit Available: No (exploit_available: false)

The inability to restrict path discovery via watches represents a significant authorization failure within the ZooKeeper coordination layer. Administrators should prioritize the deployment of the vendor-provided patches (versions 3.9.6 or 3.8.7) as the primary mitigation. Given the ease of exploitation, applying these updates is essential to maintain the integrity and confidentiality of the Znode namespace.