CVE-2026-24308

CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Vendor Apache Software Foundation
Product Apache ZooKeeper
Weakness CWE-532 · Sensitive info in logs
Published March 7, 2026
Last update July 15, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Key dates

02Disclosure timeline

March 7, 2026 CVE published
July 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-52143 WordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data Exposure CVE-2024-33922 WordPress WP Media Cleaner plugin <= 6.7.2 - Sensitive Data Exposure via Log File vulnerability CVE-2025-9985 Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File CVE-2024-31298 WordPress User Spam Remover plugin <= 1.0 - Sensitive Data Exposure via Log File vulnerability CVE-2024-34550 WordPress Dynamics 365 Integration plugin <= 1.3.17 - Sensitive Data Exposure vulnerability