High severity · published Mar 7, 2026
CVE-2026-24281
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
7.4
CVSS
0.6%
EPSS
No
On KEV
Description
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AZ
Apache ZooKeeper · Apache Software Foundation
3.9.0 through 3.9.4; 3.8.0 through 3.8.5 · source: vendor
ZO
Zookeeper · Apache
3.8.0 before 3.8.6; 3.9.0 before 3.9.5 · source: NVD
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform Expansion Pack · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Offline Knowledge Portal · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI (RHOAI) · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 2.25 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat build of Debezium 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat build of Debezium 3 · Red Hat
All versions, or not specified · source: CISA
SF
streams for Apache Kafka 3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24281
Mailing List
https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2
Mailing List
http://www.openwall.com/lists/oss-security/2026/03/07/4
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:10184
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:14272
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:14276
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:34608
More from Apache ZooKeeper
7.5
CVE-2026-79993
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
7.5
CVE-2026-59969
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
7.5
CVE-2026-59739
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
7.5
CVE-2026-24308
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
5.3
CVE-2026-84501
Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider