What is the CVSS score of CVE-2026-24308?

CVE-2026-24308 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Zookeeper are affected by CVE-2026-24308?

Apache ZooKeeper versions 3.8.5 and 3.9.4 contain a configuration handling flaw that exposes sensitive client credentials and configuration data in application logfiles, creating a data breach risk…. A patch is available.

How to fix or mitigate CVE-2026-24308?

Within 24 hours: Inventory all systems running ZooKeeper 3.8.5 or 3.9.4 and assess whether client credentials are present in current logfiles; immediately restrict logfile access permissions to authorized administrators only. Within 7 days: Search centralized logging systems, backup archives, and log aggregation platforms for any historical exposure of sensitive configuration data and initiate credential rotation for any potentially compromised secrets. Within 30 days: Upgrade to patched ZooKeeper versions (3.8.6+ or 3.9.5+) and implement log redaction rules to prevent future credential exposure in application logs.

Zookeeper CVE-2026-24308

HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-03-07 security@apache.org

GHSA-crhr-qqj8-rpxc

Apache Zookeeper Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

3.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 07, 2026 - 09:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

115 maven packages depend on org.apache.zookeeper:zookeeper (23 direct, 92 indirect)

Ecosystem-wide dependent count for version 3.9.0.

DescriptionNVD

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

AnalysisAI

Apache ZooKeeper 3.8.5 and 3.9.4 improperly log sensitive client configuration data at INFO level, allowing unauthenticated remote attackers to extract credentials and other confidential information from application logfiles. The vulnerability affects all platforms and requires no user interaction or special privileges to exploit. No patch is currently available, leaving vulnerable deployments exposed until upgrades to versions 3.8.6 or 3.9.5 are deployed.

Technical ContextAI

Classified as CWE-532 (Insertion of Sensitive Information into Log File). Affects Zookeeper. Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.