CVE-2026-24281: Apache ZooKeeper hostname verification bypass in ZKTrustManager

CVE-2026-24281 · Severity: high · CVSS 7.4 · Published 2026-03-07

Apache ZooKeeper, a service used to coordinate and manage large sets of distributed server systems, contains a security flaw in how it verifies the identity of connecting servers and clients. An attacker who can manipulate network naming records (DNS) could potentially impersonate a legitimate ZooKeeper server or client. If successful, this could allow the attacker to intercept sensitive data or disrupt the operations of the distributed system, though the attack is difficult to perform because it requires the attacker to also possess a trusted security certificate.

Technologies: org.apache.zookeeper:zookeeper (Maven), Red Hat AMQ Broker, Red Hat build of Debezium, Red Hat Streams for Apache Kafka. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-24281 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24281 being exploited in the wild.
How severe is CVE-2026-24281?
High severity, with a CVSS score of 7.4, published 7 March 2026.
Which products and versions are affected?
org.apache.zookeeper:zookeeper (Maven) ECOSYSTEM:introduced=3.8.0,fixed=3.8.6; Red Hat AMQ Broker 7.12.7, 7.13.5, 7.14.0; Red Hat build of Debezium 2, 3; Red Hat Streams for Apache Kafka 2, 3.
Is there a fix for CVE-2026-24281?
Yes. org.apache.zookeeper:zookeeper (Maven): upgrade to 3.8.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24281 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-24281?
Check whether you run org.apache.zookeeper:zookeeper (Maven), Red Hat AMQ Broker, Red Hat build of Debezium or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.zookeeper:zookeeper (Maven): upgrade to 3.8.6 or later
    # set org.apache.zookeeper:zookeeper to 3.8.6 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the Apache ZooKeeper ZKTrustManager where hostname verification incorrectly falls back to reverse DNS (PTR) lookups if IP SAN validation fails. An attacker who controls or can spoof PTR records may be able to impersonate a ZooKeeper server or client by presenting a valid certificate corresponding to the spoofed PTR name. While the attack requires the attacker to present a certificate trusted by the ZKTrustManager (increasing the difficulty), it allows for a bypass of intended hostname identity protections. The issue is addressed in ZooKeeper versions 3.8.6 and 3.9.5 by providing a configuration option to disable reverse DNS lookups in client and quorum protocols.

Affected products

  • Apache ZooKeeper 3.8.0 through 3.8.5, 3.9.0 through 3.9.4
  • Red Hat AMQ Broker 7.12.7, 7.13.5, 7.14.0
  • Red Hat OpenShift AI 2.25
  • Red Hat build of Debezium 2, 3
  • Red Hat Fuse 7
  • Red Hat streams for Apache Kafka 2, 3

Identifiers

  • CVE-2026-24281
  • GHSA-7xrh-hqfc-g7qr

Timeline

  • 2026-03-07: disclosed
  • 2026-03-07: advisory
  • 2026-03-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.