CVE-2026-24308

Description

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

PUBLISHED Reserved 2026-01-21 | Published 2026-03-07 | Updated 2026-03-07 | Assigner apache

Problem types

CWE-532 Insertion of Sensitive Information into Log File

Product status

Credits

Youlong Chen <chenyoulong20g@ict.ac.cn> reporter

References

lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr vendor-advisory

cve.org (CVE-2026-24308)

nvd.nist.gov (CVE-2026-24308)

Download JSON