Improper Configuration Handling in Apache ZooKeeper Products
CVE-2026-24308

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Zookeeper
Vendor
CVE Published:
7 March 2026

What is CVE-2026-24308?

An improper handling of configuration values in Apache ZooKeeper versions 3.8.5 and 3.9.4 can lead to the exposure of sensitive information in client configuration files. The flaw allows attackers to access confidential data through the client's logfile where configuration values are logged at the INFO level. This could potentially compromise the security of systems in production environments. Users are strongly advised to upgrade to the latest versions, 3.8.6 or 3.9.5, to mitigate this vulnerability and protect their data.

Affected Version(s)

Apache ZooKeeper 3.9.0 <= 3.9.4

Apache ZooKeeper 3.8.0 <= 3.8.5

References

https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfpl...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Youlong Chen <chenyoulong20g@ict.ac.cn>
.