CVE-2026-24308
published 2026-03-07CVE-2026-24308: Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.18%
64.3th percentile
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zookeeper | >= 0 < 3.9.5-1 | 3.9.5-1 |
| apache | zookeeper | >= 3.8.0 < 3.8.6 | 3.8.6 |
| apache | zookeeper | >= 3.9.0 < 3.9.5 | 3.9.5 |
| apache_software_foundation | apache_zookeeper | 3.8.0 – 3.8.5 | — |
| apache_software_foundation | apache_zookeeper | 3.9.0 – 3.9.4 | — |
| debian | zookeeper | < zookeeper 3.9.5-1 (forky) | zookeeper 3.9.5-1 (forky) |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
vendor_redhat·2026-03-07·CVSS 7.5
CVE-2026-24308 [HIGH] CWE-117 Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client's logfile. This vulnerability can lead
Debian
CVE-2026-24308: zookeeper - Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 ...
vendor_debian·2026·CVSS 7.5
CVE-2026-24308 [HIGH] CVE-2026-24308: zookeeper - Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 ...
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 3.9.5-1)
sid: resolved (fixed in 3.9.5-1)
trixie: open
VulDB
Apache ZooKeeper up to 3.8.5/3.9.4 Client Configuration information disclosure (EUVD-2026-10140 / Nessus ID 329220)
vuldb·2026-07-23·CVSS 7.5
CVE-2026-24308 [HIGH] Apache ZooKeeper up to 3.8.5/3.9.4 Client Configuration information disclosure (EUVD-2026-10140 / Nessus ID 329220)
A vulnerability categorized as problematic has been discovered in Apache ZooKeeper up to 3.8.5/3.9.4. This vulnerability affects unknown code of the component Client Configuration Handler. Such manipulation leads to information disclosure.
This vulnerability is documented as CVE-2026-24308. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
OSV
CVE-2026-24308: Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3
osv·2026-03-07·CVSS 7.5
CVE-2026-24308 [HIGH] CVE-2026-24308: Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
GHSA
Apache ZooKeeper has improper handling of configuration values
ghsa·2026-03-07
CVE-2026-24308 [HIGH] CWE-532 Apache ZooKeeper has improper handling of configuration values
Apache ZooKeeper has improper handling of configuration values
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
OSV
Apache ZooKeeper has improper handling of configuration values
osv·2026-03-07
CVE-2026-24308 [HIGH] Apache ZooKeeper has improper handling of configuration values
Apache ZooKeeper has improper handling of configuration values
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-68161 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68161 :
Apache Solr vulnerability analysis and mitigation
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
The attacker is able to intercept or redirect network traffic between the client and the log receiver.
The attacker can present a server certificate is
Wiz
CVE-2026-24308 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-24308 [HIGH] CVE-2026-24308 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-24308 :
Java vulnerability analysis and mitigation
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Source : NVD
## 7.5
Score
Published March 7, 2026
Severity HIGH
CNA Score 6.5
Affected Technologies
Java
Apache Solr
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 5.5
Exploitation Probability (EPSS) N/A
Affected
Bugzilla
CVE-2026-24308 Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
bugzilla·2026-03-07·CVSS 7.5
CVE-2026-24308 [HIGH] CVE-2026-24308 Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
CVE-2026-24308 Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Discussion:
This issue has been addressed in the following products:
Red Hat AMQ Broker 7.14.0
Via RHSA-2026:8509 https://access.redhat.com/errata/RHSA-2026:8509
https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdrhttp://www.openwall.com/lists/oss-security/2026/03/07/5https://access.redhat.com/errata/RHSA-2026:10184https://access.redhat.com/errata/RHSA-2026:14272https://access.redhat.com/errata/RHSA-2026:14276https://access.redhat.com/errata/RHSA-2026:34608https://access.redhat.com/errata/RHSA-2026:8509https://access.redhat.com/security/cve/CVE-2026-24308https://bugzilla.redhat.com/show_bug.cgi?id=2445451https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24308.json
2026-03-07
Published