CVE-2026-24308 is a sensitive information disclosure vulnerability in Apache ZooKeeper versions 3.8.5 and 3.9.4. It allows an attacker to expose sensitive configuration values in client logfiles due to improper handling of these values, which are logged at an INFO level. The vulnerability has a FAUCET Risk Score of 27/100, indicating a moderate risk, and is categorized under CWE-532 (Inclusion of Sensitive Information in Log Files). There is no known active exploitation, nor are there public exploit codes available in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered community attention with 3 mentions across platforms like Bluesky and Mastodon, and has been covered in one security article. Users are advised to upgrade to ZooKeeper 3.8.6 or 3.9.5 to remediate this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.8.0, < 3.8.6CPE matchmatch criteria | cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* | ||
>= 3.9.0, < 3.9.5CPE matchmatch criteria | cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* | ||
>= 3.8.0, <= 3.8.5CPE match | cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* | ||
>= 3.9.0, <= 3.9.4CPE match | cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.