CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.zookeeper:zookeeperto a version that resolves this vulnerability.Fixed in 3.8.6 - Upgrade
Upgrade
maven/org.apache.zookeeper:zookeeperto a version that resolves this vulnerability.Fixed in 3.9.5 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.8.6 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24308?
CVE-2026-24308 is rated as a high severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2026-24308?
To fix CVE-2026-24308, upgrade Apache ZooKeeper to version 3.9.5 or later, or apply any available patches for affected versions.
What versions of Apache ZooKeeper are affected by CVE-2026-24308?
CVE-2026-24308 affects Apache ZooKeeper versions 3.8.5 and 3.9.4.
What type of information can be disclosed due to CVE-2026-24308?
CVE-2026-24308 can lead to the disclosure of sensitive information stored in the client's configuration logs.
Is there a risk of exploitation for CVE-2026-24308?
Yes, there is a risk of exploitation for CVE-2026-24308, as an attacker could potentially access sensitive data from logged configuration values.