Vulnerability CVE-2026-24308: Information

Description

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Severity: HIGH (7.5)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24308

Published: March 7, 2026

Modified: March 10, 2026

Error type identifier: CWE-532

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
kafka	sisyphus	4.2.0-alt2	4.2.0-alt4	ALT-PU-2026-5782-1	414376	Fixed
kafka	sisyphus_loongarch64	4.2.0-alt3	4.2.0-alt4	ALT-PU-2026-5915-1	-	Fixed
kafka	c10f2	4.2.0-alt3	3.9.1-alt2.c10.1	ALT-PU-2026-5788-1	414377	Testing

References to Advisories, Solutions, and Tools

Hyperlink	Resource
https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/07/5	Mailing List Third Party Advisory
GHSA-crhr-qqj8-rpxc

Affected configurations:
1. cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
  Start including
  3.8.0
  End excluding
  3.8.6
  cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
  Start including
  3.9.0
  End excluding
  3.9.5

Version: v26.2.2