LiveActive security incident?Get immediate response
CVE Record

CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Apache ZooKeeper can write sensitive client configuration values into client log files at INFO level. This is mainly a confidentiality issue: secrets may be exposed through application or centralized logs. The source bundle recommends upgrading affected ZooKeeper branches to fixed releases.

Executive priority

Treat this as a timely remediation item for systems that store secrets in ZooKeeper client configuration or centralize application logs. It is not described as actively exploited, but exposed credentials can create downstream compromise risk.

Technical view

Improper ZKConfig handling in Apache ZooKeeper 3.8.5 and 3.9.4 exposes client configuration values in client log files. The CVSS 3.1 score is 6.5, with high confidentiality impact and no integrity or availability impact. The bundle maps this to CWE-117 and CWE-532.

Likely exposure

Organizations using Apache ZooKeeper clients version 3.8.5 or 3.9.4, including the org.apache.zookeeper:zookeeper package, are the clearest exposure. Risk is higher where client logs are centralized, broadly searchable, retained long-term, or contain secrets in configuration.

Exploitation context

The bundle does not cite active exploitation, and KEV is false. The practical concern is disclosure through logs rather than code execution. The exact attacker path is not fully detailed, but CVSS indicates low privileges and no user interaction.

Researcher notes

The strongest evidence is the Apache advisory summary and CVE metadata. Version detail in the bundle names 3.8.5 and 3.9.4 with fixes in 3.8.6 and 3.9.5. Affected-version metadata appears sparse, so validate against vendor advisories.

Mitigation direction

  • Upgrade Apache ZooKeeper to 3.8.6 or 3.9.5 as applicable.
  • Apply relevant Red Hat errata where ZooKeeper is supplied by Red Hat.
  • Review logs for exposed secrets and rotate any confirmed leaked values.
  • Restrict access to client and centralized logs containing ZooKeeper output.
  • Check vendor guidance for any environment-specific remediation steps.

Validation and detection

  • Inventory applications using org.apache.zookeeper:zookeeper and record effective ZooKeeper versions.
  • Confirm no affected ZooKeeper client versions remain in production builds.
  • Review client logs for ZKConfig output that includes sensitive configuration values.
  • Use approved secret-scanning processes on retained logs.
  • Verify deployed packages match Apache or Red Hat fixed versions.
Prepared
Confidence
high
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-117: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-532: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-24308 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
3ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6CISA-ADP
3.3CVSS 3.1LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N1.81.4redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

6.5Medium
CVSS 3.1 vector shape for CVE-2026-24308Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
redhat-SADPApache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
other:Red Hat severity ratingcvssV3_1
  • 2026-03-07T09:01:03.859Z: Reported to Red Hat.
  • 2026-03-07T08:51:17.567Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Apache Software FoundationApache ZooKeeperorg.apache.zookeeper:zookeeper, 3.9.0, 3.8.0unaffected
Weakness

CWE details

CWE-117CWE-532

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-117 · source CWE mapping

Improper Output Neutralization for Logs

Improper Output Neutralization for Logs represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-532 · source CWE mapping

Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs