High severity · published Mar 7, 2026
CVE-2026-24308
Apache ZooKeeper: Sensitive information disclosure in client configuration handling
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AZ
Apache ZooKeeper · Apache Software Foundation
3.9.0 through 3.9.4; 3.8.0 through 3.8.5 · source: vendor
ZO
Zookeeper · Apache
3.8.0 before 3.8.6; 3.9.0 before 3.9.5 · source: NVD
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform 7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat JBoss Enterprise Application Platform Expansion Pack · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI (RHOAI) · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 2.25 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat build of Debezium 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat build of Debezium 3 · Red Hat
All versions, or not specified · source: CISA
SF
streams for Apache Kafka 3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24308
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24308
Mailing List
https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr
Mailing List
http://www.openwall.com/lists/oss-security/2026/03/07/5
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:10184
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:14272
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:14276
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:34608
More from Apache ZooKeeper
7.5
CVE-2026-79993
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
7.5
CVE-2026-59969
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
7.5
CVE-2026-59739
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
7.4
CVE-2026-24281
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
5.3
CVE-2026-84501
Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider