Every CVESearch/Get API key

CVE-2026-24308

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

7.5 HighFix available

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.29%Up 1.3 points since Mar 7, 2026
90%50%10%1%

What each source reports

NVD Score used7.5

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
CVE-2026-24308
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-532, CWE-117
Updated
2026-11-02
CVE List6.5

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
CVE-2026-24308
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-532, CWE-117
Updated
2026-11-02
EUVDEUVD-2026-101406.5

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
EUVD-2026-10140
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-crhr-qqj8-rpxc8.7

Apache ZooKeeper has improper handling of configuration values

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
GHSA-crhr-qqj8-rpxc
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-532
Updated
2026-11-02
OSV6.5

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
CVE-2026-24308
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVDEBIAN-CVE-2026-243087.5

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
DEBIAN-CVE-2026-24308
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-crhr-qqj8-rpxc8.7

Apache ZooKeeper has improper handling of configuration values

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
GHSA-crhr-qqj8-rpxc
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-532
Updated
2026-11-02
OSVRHLW-2026-19f4511248f79d695.3

Lightwell Security Advisory: zookeeper 3.8.3.rhlw-00015

Red Hat Lightwell has released org.apache.zookeeper:zookeeper 3.8.3.rhlw-00015 with backported fixes for CVE-2024-23944, CVE-2026-24308, CVE-2026-59739, CVE-2026-59969, CVE-2026-79993, CVE-2026-84439, and CVE-2026-84501.

CVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling

CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling

CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

This patched artifact is a drop-in replacement for org.apache.zookeeper:zookeeper 3.8.3 from Maven Central.

Record
RHLW-2026-19f4511248f79d69
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-10
OSVROOT-APP-MAVEN-CVE-2026-243087.5

CVE-2026-24308 in io.root.org.apache.zookeeper:zookeeper - Patched by Root

Root has patched CVE-2026-24308 in the io.root.org.apache.zookeeper:zookeeper package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-24308
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-243087.5

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
UBUNTU-CVE-2026-24308
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-zookeeper-2026-24308No score

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Record
BIT-zookeeper-2026-24308
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
org.apache.zookeeper:zookeeper
Maven
3.9.0 up to 3.9.5
3.9.5
org.apache.zookeeper:zookeeper
Maven
3.8.0 up to 3.8.6
3.8.6
zookeeper
Bitnami
3.8.0 up to 3.8.6, 3.9.0 up to 3.9.5
3.8.63.9.5
zookeeper
Debian:12
All versions, plus listed versions
3.8.0-113.8.0-11+deb12u13.8.0-11+deb12u23.9.1-13.9.2-1
Show 8 moreShow less
3.9.2-23.9.3-13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1
None known
zookeeper
Debian:13
All versions, plus listed versions
3.9.3-13.9.3-1+deb13u13.9.3-23.9.4-13.9.4-23.9.5-13.9.5-23.9.6-1
None known
zookeeper
Debian:14
before 3.9.5-1, plus listed versions
3.9.3-13.9.3-23.9.4-13.9.4-2
3.9.5-1
org.apache.zookeeper:zookeeper
Maven
3.9.0 up to 3.9.5, plus listed versions
3.9.13.9.23.9.33.9.4
3.9.5
org.apache.zookeeper:zookeeper
Maven
3.8.0 up to 3.8.6, plus listed versions
3.8.13.8.23.8.33.8.43.8.5
3.8.6
org.apache.zookeeper:zookeeper
Red Hat Lightwell:Maven
From an advisory covering 7 CVEs
before 3.8.3.rhlw-00015, plus listed versions
3.3.03.3.13.3.23.3.33.3.4
Show 40 moreShow less
3.3.53.3.63.4.03.4.13.4.103.4.113.4.123.4.133.4.143.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.93.5.0-alpha3.5.1-alpha3.5.103.5.2-alpha3.5.3-beta3.5.4-beta3.5.53.5.63.5.73.5.83.5.93.6.03.6.13.6.23.6.33.6.43.7.03.7.13.7.23.8.03.8.13.8.23.8.3
3.8.3.rhlw-00015
io.root.org.apache.zookeeper:zookeeper
Root:Maven
before 3.8.4-root.io.1
3.8.4-root.io.13.9.3-root.io.13.9.3-root.io.23.9.2-root.io.13.9.2-root.io.23.8.4-root.io.23.8.4-root.io.33.9.3-root.io.33.9.2-root.io.3
Show 10 moreShow less
Affected packages
PackageAffectedFixed
org.apache.zookeeper:zookeeper
Root:Maven
before 3.8.4-aikido.3
3.8.4-aikido.33.9.3-aikido.33.9.2-aikido.3
zookeeper
Ubuntu:Pro:14.04:LTS
All versions, plus listed versions
3.4.5+dfsg-13.4.5+dfsg-1ubuntu0.1~esm13.4.5+dfsg-1ubuntu0.1~esm3
None known
zookeeper
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
3.4.6-83.4.7-13.4.8-13.4.8-1ubuntu0.1~esm13.4.8-1ubuntu0.1~esm2
None known
zookeeper
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
3.4.10-23.4.10-33.4.13-33.4.13-3ubuntu0.1~esm1
None known
zookeeper
Ubuntu:20.04:LTS
All versions, plus listed versions
3.4.13-13.4.13-33.4.13-3build13.4.13-43.4.13-53.4.13-5build13.4.13-5ubuntu0.1
None known
zookeeper
Ubuntu:22.04:LTS
All versions, plus listed versions
3.4.13-5ubuntu43.4.13-6ubuntu23.4.13-6ubuntu33.4.13-6ubuntu43.4.13-6ubuntu4.1
None known
zookeeper
Ubuntu:24.04:LTS
All versions, plus listed versions
3.8.0-113.9.1-13.9.1-1build13.9.1-1build2
None known
zookeeper
Ubuntu:25.10
All versions, plus listed versions
3.9.3-1build13.9.3-1build2
None known
zookeeper
Ubuntu:26.10
All versions, plus listed versions
3.9.5-13.9.5-2
None known
zookeeper
Ubuntu:26.04:LTS
All versions, plus listed versions
3.9.3-1build23.9.3-1build33.9.4-13.9.5-1
None known

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24308 is a high vulnerability (CVSS 7.5) in Apache Zookeeper, published March 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. Fixed in org.apache.zookeeper:zookeeper 3.9.5.

References

Show 33 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open