A critical authorization bypass in Apache ZooKeeper allows unauthenticated remote attackers to delete znodes, potentially leading to significant data loss or service disruption.

This vulnerability is a missing authorization flaw (CWE-862) occurring because the deleteContainer opcode (0x14/20) processes requests without verifying caller ACL permissions. An unauthenticated attacker can bypass all security checks by issuing raw protocol requests directly to the ZooKeeper client port.

Successful exploitation allows unauthorized deletion of data structures within the ZooKeeper tree. Because ZooKeeper is often used for distributed coordination and configuration management, this could lead to widespread system instability, service outages, or the loss of critical application state. With a CVSS score of 7.5, this vulnerability represents a high risk to availability and integrity.

Immediate Action: Upgrade to Apache ZooKeeper version 3.9.6 or 3.8.7 immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Monitor network traffic to the ZooKeeper client port (default 2181) for anomalous raw protocol requests or unexpected deleteContainer opcode usage.

Compensating Controls: If immediate patching is not feasible, restrict network access to the ZooKeeper client port using firewall rules to ensure only trusted, authorized clients can communicate with the service.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for severe service disruption, administrators should prioritize patching affected ZooKeeper clusters. Applying the vendor-supplied update is the only definitive way to close this authorization gap and ensure that all znode operations are subjected to appropriate ACL enforcement.