Security1 hOctober 24, 2026, 19:02

ZooKeeper client port scans don't measure exposed quorums

ZoomEye returns 2,432,899 hosts on port 2181 but only 93,303 matching the Apache ZooKeeper fingerprint. After four September advisories, including the ACL bypass CVE-2026-79993 and an incomplete fix for CVE-2024-23944, the author urges reconciling inventory against versions 3.9.6 and 3.8.7 rather than external scans.

DEV Community

Open source

ZooKeeper client port scans don't measure exposed quorums

Port 2181: 2,432,899 hosts vs 93,303 ZooKeeper fingerprint matches
CVE-2026-79993: znode delete skips ACL checks in 3.9.0–3.9.5 and 3.8.0–3.8.6
CVE-2026-59739: incomplete fix for CVE-2024-23944 leaks node paths
Quorum ports 2888 and 3888 returned 5 and 1 matches

#Apache#ZooKeeper#ZoomEye

ZoomEye Scan Finds 4.1 Million Hosts Exposing Port 6443

Security

CVE-2026-59739 in ZooKeeper: existence watches leak restricted znode names

Security

Apache ZooKeeper authorization bypass found in deleteContainer path

Security

ZooKeeper client port scans don't measure exposed quorums

ZoomEye Scan Finds 4.1 Million Hosts Exposing Port 6443

CVE-2026-59739 in ZooKeeper: existence watches leak restricted znode names

Apache ZooKeeper authorization bypass found in deleteContainer path

Estonia's public-sector attack surface measured after September DDoS wave