CVE-2026-24308: apache software foundation apache zookeeper
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2026-24308DEBIAN-CVE-2026-24308CGA-2c6x-f32f-6jjpCGA-2w86-fggc-w58qCGA-49p8-h8pc-7r5hCGA-4rfp-v2fg-f85vCGA-56rm-wqmg-q92fCGA-5q7c-gggr-xmjhCGA-5vgf-hh2f-xp86CGA-5vq6-948p-55x4CGA-664v-mwwc-xvv5CGA-69h3-6jp5-pqfrCGA-6xj3-6q8h-vc3jCGA-7287-745x-hfgfCGA-7jhm-g7g5-p3wrCGA-7prr-rm2g-v238CGA-7vf6-2r45-3j3cCGA-8223-xx36-whcjCGA-85wj-5mcm-p8qwCGA-8wqg-672p-qwqmCGA-93mj-xgp4-c46gCGA-96wh-qjm6-rq2jCGA-9chr-79p5-4g9mCGA-9pqv-72pv-r5rfCGA-c2vq-4rgr-9jg8CGA-c4hc-6jm2-5x7xCGA-cfhq-p5j9-m9c7CGA-ff92-9653-qg7xCGA-fr3w-vqff-2pwmCGA-frph-vhv3-7q96CGA-fwc8-762h-39wpCGA-g28v-8895-qrcqCGA-g4r3-q5vj-f4qcCGA-hpx6-hrgj-qm6hCGA-hvc9-xwxp-qw26CGA-j43g-7x3v-3jh6CGA-j4p5-vpjh-7w4fCGA-jg75-hx22-wx75CGA-jx9x-h784-38jqCGA-mhr5-mgcq-88pgCGA-p34f-hw3q-h558CGA-p44j-8339-736vCGA-p5r8-4rxg-qfq9CGA-ppx6-p59w-9jvvCGA-q569-cvv3-m9vrCGA-q63c-xx3m-4fg7CGA-r55p-3q22-rr4wCGA-r62m-c6vm-fm9rCGA-r7p3-2fcf-r523CGA-rjv8-x5vp-8c3wCGA-rvxc-4wq5-j5mmCGA-v37x-fm8w-43f9CGA-v534-425p-ph8hCGA-w7vc-ccf5-f5f5CGA-wcrw-3wjw-jj46CGA-wfc5-37wq-68hrCGA-whv4-9gf7-9g7vCGA-ww6h-j4q7-mjc9CGA-x4m6-w77f-r3xmCGA-x4xq-4hh8-g4j8CGA-x78x-r9qf-8v8vCGA-xh6w-q7r6-ph6hCGA-xrvm-52hf-c96qCGA-27wf-p944-29gcCGA-2j95-4jp8-vhv3CGA-34xh-fhrv-hgh6CGA-4w5g-295q-w9wrCGA-4xxc-h758-vhq8CGA-57jg-779r-367hCGA-649j-9f7h-2f7wCGA-7pjg-7qjc-hr9gCGA-83mm-gxf6-2hq4CGA-878p-73pj-gxpfCGA-8gmr-7r43-q495CGA-8pqv-m8g4-xj8fCGA-98cg-8rjr-cccpCGA-9chx-gfpq-gx2cCGA-9gq7-pgh8-7pw5CGA-9hh6-86f5-8xj3CGA-9hp2-j7r3-m24gCGA-9x93-qg28-86hpCGA-c6fv-87jv-r87gCGA-c9fx-f6r5-77x2CGA-f456-8rh6-jg39CGA-gf27-wwj4-qg73CGA-h7q8-qf5q-9gcvCGA-hq35-25j7-46r4CGA-j75m-78x6-mm95CGA-jff7-hj8r-wf77CGA-jwxp-9mw4-vv29CGA-jx4f-p32f-7358CGA-pfrr-39fg-p257GHSA-crhr-qqj8-rpxcBIT-zookeeper-2026-24308CGA-q237-qh5q-p6cjCGA-q999-529j-j2v3CGA-q9f5-4cm6-vrpgCGA-r2rx-qv3j-q4p8CGA-rfgf-qhch-2fhjCGA-w53w-99cx-5pp4CGA-w645-hpvr-7hr6CGA-wmwv-j8g5-c793CGA-wx5p-j27w-97pmCGA-x249-8gjm-q8xgCGA-x5v9-9r59-82j8
Published 07-03-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-24308 is a high (CVSS 7.5) vulnerability in apache software foundation apache zookeeper. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 67.6% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.20%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 07-03-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
CVSS metrics
7 scores · 7 sources · 2 versionsHigh 8.7Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources6 sources · 6.5–7.5
- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
+0.02 pp
From 1.18% on 18-09-2026
18-09-202618-10-2026
EPSS score1.20%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
- CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Affected systems
Chainguard49 products
- akhq< 0.26.0-r11
- apache-activemq-artemis< 2.53.0-r2
- apache-nifi< 2.8.0-r4
- apache-pulsar-4.0< 4.0.9-r6
- apache-pulsar-4.1< 4.1.3-r7
Wolfi31 products
- akhq< 0.26.0-r11
- apache-activemq-artemis< 2.53.0-r2
- apache-nifi< 2.8.0-r4
- apache-pulsar-4.1< 4.1.3-r7
- confluent-common-dockerAll versions (No fix recorded)
Apache1 product
- zookeeper≥ 3.8.0, < 3.8.6 | ≥ 3.9.0, < 3.9.5
Apache software foundation1 product
- apache zookeeper≥ 3.9.0, ≤ 3.9.4 | ≥ 3.8.0, ≤ 3.8.5
Debian1 product
- zookeeperAll versions (No fix recorded) | < 3.9.5-1
Org.apache.zookeeper1 product
- zookeeper≥ 3.9.0, < 3.9.5 | ≥ 3.8.0, < 3.8.6
Ubuntu1 product
- zookeeperAll versions (No fix recorded)
7 vendors · 85 products
References
19 links- lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdrVendor AdvisoryREPORTAdvisoryWEBMailing List
Show all 19 references
- github.com/apache/zookeeperPACKAGE