Apache ZooKeeper has improper handling of configuration values

CVE-2026-24308 · Published Mar 7, 2026 · updated Sep 10, 2026

High

Fix: upgrade to 3.8.6 or later (2 fixed versions below)

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Affected versions

Package	Affected	Fixed in
org.apache.zookeeper:zookeeper Maven	>= 3.9.0, < 3.9.5	3.9.5
	>= 3.8.0, < 3.8.6	3.8.6

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-532
Also known as: BIT-zookeeper-2026-24308, CVE-2026-24308

More Apache ZooKeeper advisories

All Apache ZooKeeper

High 7.4Mar 7

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerCVE-2026-24281fixed in 3.8.6 +1 Medium 4.3Sep 24, 2025

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore CommandsCVE-2025-58457fixed in 3.9.4 HighNov 7, 2024

Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerCVE-2024-51504fixed in 3.9.3 Medium 5.3Mar 15, 2024

Apache ZooKeeper vulnerable to information disclosure in persistent watchers handlingCVE-2024-23944fixed in 3.8.4 +1 Critical 9.1Oct 11, 2023

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeperCVE-2023-44981fixed in 3.7.2 +2 High 7.5May 13, 2022

Uncontrolled Resource Consumption in Apache ZooKeeperCVE-2017-5637fixed in 3.4.10 +1