`deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

{
  "id": "54c91987b5029dbe2d9f82fecf88c043269682cd0bdfb6ab457ac343d29ac7af",
  "url": "https://osv.dev/vulnerability/CLEANSTART-2026-VL27493",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "`deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...",
    "summary": "Security vulnerability affects the spark package. The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent.",
    "evidence": "osv:CLEANSTART-2026-VL27493",
    "products": [
      {
        "name": {
          "value": "spark",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.5.9-r3",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CLEANSTART-2026-VL27493",
      "aliases": [
        "CLEANSTART-2026-VL27493"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3.5.9-r3"
                }
              ]
            }
          ],
          "package": {
            "name": "spark",
            "purl": "pkg:apk/cleanstart/spark",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VL27493.json"
          }
        }
      ],
      "modified": "2026-10-08T16:47:31.617589660Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-79993"
      ],
      "references": [
        "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VL27493.json",
        "https://osv.dev/vulnerability/CVE-2026-79993",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-79993"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2026-79993",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 103424,
  "published_at": "2026-10-07T00:36:23.253+00:00"
}