CVE-2026-24308: Apache ZooKeeper sensitive information disclosure in ZKConfig log output

CVE-2026-24308 · Severity: high · CVSS 7.5 · Published 2026-03-07

Apache ZooKeeper is a service used to coordinate and manage configuration for large distributed systems. A vulnerability in how it handles client settings causes sensitive information to be written into plain-text log files. If an attacker gains access to these logs, they could obtain credentials or other private configuration data, potentially leading to further unauthorized access to the production environment.

Technologies: org.apache.zookeeper:zookeeper (Maven), Red Hat AMQ Broker, Red Hat build of Debezium, Red Hat Streams for Apache Kafka. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-24308 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-24308 being exploited in the wild.
How severe is CVE-2026-24308?
High severity, with a CVSS score of 7.5, published 7 March 2026.
Which products and versions are affected?
org.apache.zookeeper:zookeeper (Maven) ECOSYSTEM:introduced=3.9.0,fixed=3.9.5; Red Hat AMQ Broker 7.12.7, 7.13.5, 7.14.0; Red Hat build of Debezium 2, 3; Red Hat Streams for Apache Kafka 2, 3.
Is there a fix for CVE-2026-24308?
Yes. org.apache.zookeeper:zookeeper (Maven): upgrade to 3.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24308 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-24308?
Check whether you run org.apache.zookeeper:zookeeper (Maven), Red Hat AMQ Broker, Red Hat build of Debezium or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.zookeeper:zookeeper (Maven): upgrade to 3.9.5 or later
    # set org.apache.zookeeper:zookeeper to 3.9.5 in your pom.xml or build.gradle

Technical details

A sensitive information disclosure vulnerability exists in Apache ZooKeeper's ZKConfig component. The software improperly handles configuration values, causing them to be recorded in client log files at the standard INFO logging level. This behavior can expose sensitive credentials or secrets stored within the client configuration to anyone with read access to the logs. The issue affects versions 3.8.0 through 3.8.5 and 3.9.0 through 3.9.4. Users are advised to upgrade to versions 3.8.6 or 3.9.5 to ensure sensitive values are properly neutralized before logging.

Affected products

  • Apache ZooKeeper 3.8.0 through 3.8.5, 3.9.0 through 3.9.4
  • Red Hat AMQ Broker 7.12.7, 7.13.5, 7.14.0
  • Red Hat OpenShift AI 2.25
  • Red Hat build of Debezium 2, 3
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat streams for Apache Kafka 2, 3

Identifiers

  • CVE-2026-24308
  • GHSA-crhr-qqj8-rpxc

Timeline

  • 2026-03-07: disclosed: Initial disclosure via Apache and Openwall mailing lists
  • 2026-03-07: advisory: NVD record published
  • 2026-04-23: patched: Red Hat released security advisories for affected products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.