Read the docs
TI-2026-19592 Aliases CVE-2026-24308GHSA-crhr-qqj8-rpxc

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Priority LOW 35CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01289 70th percentileScored 2026-11-07
Fix Partial org.apache.zookeeper:zookeeper (Maven): 3.9.5, 3.8.6Red Hat: 6 advisoriesRed Hat: 6 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ZooKeeper3.9.0 – 3.9.4; 3.8.0 – 3.8.5—No fix listedCNA
—org.apache.zookeeper:zookeeper (Maven)3.9.0 to before 3.9.53.9.5Patch availableGHSA-crhr-qqj8-rpxc
—org.apache.zookeeper:zookeeper (Maven)3.8.0 to before 3.8.63.8.6Patch availableGHSA-crhr-qqj8-rpxc
  • Apache ZooKeeper VendorApache Affected 3.9.0 – 3.9.4; 3.8.0 – 3.8.5 Fixed in — No fix listed CNA
  • org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.9.0 to before 3.9.5 Fixed in 3.9.5 Patch available GHSA-crhr-qqj8-rpxc
  • org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.8.0 to before 3.8.6 Fixed in 3.8.6 Patch available GHSA-crhr-qqj8-rpxc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*3.8.0 to before 3.8.6; 3.9.0 to before 3.9.5VulnerableApache
  • cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions 3.8.0 to before 3.8.6; 3.9.0 to before 3.9.5 Vulnerable ·Apache

Remediation

  • Fix · GHSA-crhr-qqj8-rpxc org.apache.zookeeper:zookeeper (Maven) Fixed in 3.9.5 Advisory →
  • Fix · GHSA-crhr-qqj8-rpxc org.apache.zookeeper:zookeeper (Maven) Fixed in 3.8.6 Advisory →

Red Hat 6 advisories

  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:19678 Released 2026-05-20 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 XP 6.0.4.GA security release
    • Red Hat JBoss Enterprise Application Platform 6.0.4.GA io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, org.apache.zookeeper.zookeeper-3.8.6.redhat-00001.jar
  • RHSA-2026:14276 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.12.7 release and security update
    • Red Hat AMQ Broker 7.12.7
Show 3 more Red Hat advisories
  • RHSA-2026:14272 Released 2026-05-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.5 release and security update
    • Red Hat AMQ Broker 7.13.5
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:8509 Released 2026-04-16 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.0 release and security update
    • Red Hat AMQ Broker 7.14.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
streams for Apache Kafka 3AffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7.12.7Fixed RHSA-2026:14276
Red Hat AMQ Broker 7.13.5Fixed RHSA-2026:14272
Red Hat AMQ Broker 7.14.0Fixed RHSA-2026:8509
Red Hat JBoss Enterprise Application Platform 6.0.4.GAFixed RHSA-2026:19678
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Not affected: 6 products
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 6.0.4.GA
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI 2.25
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24308
  2. 2026-10-03 Alias added: GHSA-crhr-qqj8-rpxc
  3. 2026-10-09 Fix available: RHSA-2026:8509 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:14272 · Red Hat
  5. 2026-10-10 Fix available: RHSA-2026:19678 · Red Hat
  6. 2026-10-10 Fix available: Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.0, Red Hat JBoss Enterprise Application Platform 6.0.4.GA · Red Hat
  7. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 3

Other 3

  • TI-2017-03638 Missing authentication in Apache ZooKeeper CVSS 3.0HIGH 7.5
  • TI-2023-24043 Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication CVSS 3.1CRITICAL 9.1
  • TI-2021-04395 Possible request smuggling in HTTP/2 due missing validation CVSS 3.1MEDIUM 5.9
  • TI-2024-34425 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server CVSS 3.1CRITICAL 9.1
  • TI-2016-04336 Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before… CVSS 3.0HIGH 8.1
  • TI-2018-05789 Missing authorization in Apache ZooKeeper CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences