CVE-2026-24308
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
CVE-2026-24308- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532, CWE-117
- Updated
- 2026-11-02
CVE List
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
CVE-2026-24308- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532, CWE-117
- Updated
- 2026-11-02
EUVDEUVD-2026-10140
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
EUVD-2026-10140- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-crhr-qqj8-rpxc
Apache ZooKeeper has improper handling of configuration values
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
GHSA-crhr-qqj8-rpxc- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
CVE-2026-24308- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-24308
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
DEBIAN-CVE-2026-24308- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-crhr-qqj8-rpxc
Apache ZooKeeper has improper handling of configuration values
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
GHSA-crhr-qqj8-rpxc- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-24308
CVE-2026-24308 in io.root.org.apache.zookeeper:zookeeper - Patched by Root
Root has patched CVE-2026-24308 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-24308- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-24308
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
UBUNTU-CVE-2026-24308- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-zookeeper-2026-24308 No score
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Record
BIT-zookeeper-2026-24308- Updated
- 2026-11-02
Affected products
- apache zookeeper
- apache software foundation zookeeper
- red hat amq broker 7.12.7
- red hat amq broker 7.13.5
- red hat amq broker 7.14.0
- red hat build of apache camel for spring boot 4
- red hat build of debezium 2
- red hat build of debezium 3
- red hat data grid 8
- red hat fuse 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.zookeeper:zookeeperMaven |
3.9.0 up to 3.9.5 | 3.9.5 |
org.apache.zookeeper:zookeeperMaven |
3.8.0 up to 3.8.6 | 3.8.6 |
zookeeperBitnami |
3.8.0 up to 3.8.6, 3.9.0 up to 3.9.5 | 3.8.63.9.5 |
zookeeperDebian:12 |
All versions, plus listed versions 3.8.0-113.8.0-11+deb12u13.8.0-11+deb12u23.9.1-13.9.2-1 Show 8 moreShow less3.9.2-23.9.3-13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 |
None known |
zookeeperDebian:13 |
All versions, plus listed versions 3.9.3-13.9.3-1+deb13u13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1 |
None known |
zookeeperDebian:14 |
before 3.9.5-1, plus listed versions 3.9.3-13.9.3-23.9.4-13.9.4-2 |
3.9.5-1 |
org.apache.zookeeper:zookeeperMaven |
3.9.0 up to 3.9.5, plus listed versions 3.9.13.9.23.9.33.9.4 |
3.9.5 |
org.apache.zookeeper:zookeeperMaven |
3.8.0 up to 3.8.6, plus listed versions 3.8.13.8.23.8.33.8.43.8.5 |
3.8.6 |
io.root.org.apache.zookeeper:zookeeperRoot:Maven |
before 3.8.4-root.io.1 | 3.8.4-root.io.13.9.3-root.io.13.9.3-root.io.23.9.2-root.io.13.9.2-root.io.23.8.4-root.io.23.8.4-root.io.33.9.3-root.io.33.9.2-root.io.3 |
org.apache.zookeeper:zookeeperRoot:Maven |
before 3.8.4-aikido.3 | 3.8.4-aikido.33.9.3-aikido.33.9.2-aikido.3 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
zookeeperUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.4.5+dfsg-13.4.5+dfsg-1ubuntu0.1~esm13.4.5+dfsg-1ubuntu0.1~esm3 |
None known |
zookeeperUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.4.6-83.4.7-13.4.8-13.4.8-1ubuntu0.1~esm13.4.8-1ubuntu0.1~esm2 |
None known |
zookeeperUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.4.10-23.4.10-33.4.13-33.4.13-3ubuntu0.1~esm1 |
None known |
zookeeperUbuntu:20.04:LTS |
All versions, plus listed versions 3.4.13-13.4.13-33.4.13-3build13.4.13-43.4.13-53.4.13-5build13.4.13-5ubuntu0.1 |
None known |
zookeeperUbuntu:22.04:LTS |
All versions, plus listed versions 3.4.13-5ubuntu43.4.13-6ubuntu23.4.13-6ubuntu33.4.13-6ubuntu43.4.13-6ubuntu4.1 |
None known |
zookeeperUbuntu:24.04:LTS |
All versions, plus listed versions 3.8.0-113.9.1-13.9.1-1build13.9.1-1build2 |
None known |
zookeeperUbuntu:25.10 |
All versions, plus listed versions 3.9.3-1build13.9.3-1build2 |
None known |
zookeeperUbuntu:26.10 |
All versions, plus listed versions 3.9.5-13.9.5-2 |
None known |
zookeeperUbuntu:26.04:LTS |
All versions, plus listed versions 3.9.3-1build23.9.3-1build33.9.4-13.9.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-24308 is a high vulnerability (CVSS 7.5) in Apache Zookeeper, published March 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. Fixed in org.apache.zookeeper:zookeeper 3.9.5.
References
lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr
openwall.com/lists/oss-security/2026/03/07/5
access.redhat.com/security/cve/CVE-2026-24308
bugzilla.redhat.com/show_bug.cgi?id=2445451
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-24308
github.com/apache/zookeeper/releases/tag/release-3.8.6
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-24308
ubuntu.com/security/CVE-2026-24308
cve.org/CVERecord?id=CVE-2026-24308