CLEANSTART-2026-OH00346
See a problem?- Import Source
- https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-OH00346.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLEANSTART-2026-OH00346
- Upstream
- Published
- 2026-10-30T11:02:36Z
- Modified
- 2026-10-31T01:01:45Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...
- Details
-
CVE-2026-79993 affects multiple packages. The
deleteContaineropcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for individual vulnerability details. - References
Affected packages
CleanStart / apache-hive
Package
- Name
- apache-hive
- Purl
- pkg:apk/cleanstart/apache-hive
CleanStart / apache-hive
Package
- Name
- apache-hive
- Purl
- pkg:apk/cleanstart/apache-hive
CleanStart / wso2is
Package
- Name
- wso2is
- Purl
- pkg:apk/cleanstart/wso2is
CleanStart / wso2am
Package
- Name
- wso2am
- Purl
- pkg:apk/cleanstart/wso2am