What is the CVSS score of CVE-2026-24281?

CVE-2026-24281 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Zookeeper are affected by CVE-2026-24281?

Apache ZooKeeper deployments are vulnerable to server impersonation attacks through DNS spoofing, potentially allowing attackers to intercept or manipulate cluster communications and compromise data…. A patch is available.

Is there a public PoC exploit available for CVE-2026-24281?

Yes, a public proof-of-concept exploit is available for CVE-2026-24281. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-24281?

Within 24 hours: Inventory all ZooKeeper instances and document network exposure; assess whether PTR records are controlled by trusted infrastructure. Within 7 days: Implement network segmentation to restrict ZooKeeper communication to trusted internal networks only; disable reverse DNS lookups in ZooKeeper configuration if possible. Within 30 days: Monitor vendor advisories for patch availability; evaluate migration to alternative distributed coordination systems or request vendor timeline for fix; implement enhanced monitoring for suspicious certificate validation or DNS anomalies.

Zookeeper CVE-2026-24281

HIGH

Improper Certificate Validation (CWE-295)

2026-03-07 security@apache.org

GHSA-7xrh-hqfc-g7qr

Apache Zookeeper Information Disclosure

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Red Hat

7.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 07, 2026 - 09:16 nvd

HIGH 7.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

461 maven packages depend on org.apache.zookeeper:zookeeper (90 direct, 372 indirect)

Ecosystem-wide dependent count for version 3.8.0.

DescriptionNVD

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

AnalysisAI

Hostname verification bypass in Apache ZooKeeper's ZKTrustManager allows attackers with a valid certificate trusted by the server to impersonate ZooKeeper nodes by exploiting fallback to reverse DNS validation when IP SAN checks fail. An attacker controlling or spoofing PTR records can intercept and forge communications between ZooKeeper servers and clients, compromising confidentiality and integrity of the cluster. No patch is currently available; mitigation requires upgrading to ZooKeeper 3.8.6 or 3.9.5 or disabling reverse DNS lookup via configuration.

Technical ContextAI

Classified as CWE-295 (Improper Certificate Validation). Affects Zookeeper. Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introduc