The deleteContainer operation is processed without verifying the caller’s ACL permissions, enabling any client that can communicate over ZooKeeper’s client port to delete znode entries that otherwise would be protected, including empty persistent, container, and TTL nodes. The bug is an authorization bypass that removes the normal session and DELETE ACL checks enforced by the ordinary delete command. An attacker can therefore compromise the configuration and integrity of the ZooKeeper data tree, potentially disrupting services that rely on ZooKeeper for coordination or metadata storage.

Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 are affected. The issue has been fixed in 3.8.7 and 3..

The CVSS score is not provided, and the EPSS score is unavailable, so the likelihood of exploitation cannot be quantified. However, the exploit does not require any special privileges or authentication; a client can open a plain TCP session on the default ZooKeeper port and issue the deleteContainer opcode. The vulnerability is listed in the KEV catalog as not present, suggesting no confirmed widespread exploitation yet, but the inherent lack of authentication makes it a high‑impact risk if the ZooKeeper service is publicly reachable.