CVE-2026-24308CWE-532

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Medium · published March 7, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
67.9
In the wild
Unconfirmed
What it is

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01197 · 67.9th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-03-07T08:51Z
EPSS history
Timeline
  • 07 MAR 08:51Z
    Apache ZooKeeper: Sensitive information disclosure in client configuration handling
    cvelistv5