Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Apache ZooKeeper exposes sensitive config data in logs

CVE-2026-24308 GHSA-crhr-qqj8-rpxc GHSA-crhr-qqj8-rpxc BIT-zookeeper-2026-24308
Summary

Apache ZooKeeper on certain versions logs sensitive configuration values in the log file, potentially exposing them to unauthorized parties. This can be a concern for production systems. To protect your system, upgrade to version 3.8.6 or 3.9.5.

What to do
  • Update org.apache.zookeeper:zookeeper to version 3.9.5.
  • Update org.apache.zookeeper:zookeeper to version 3.8.6.
  • Update zookeeper to version 3.9.5.
Affected software
VendorProductAffected versionsFix available
– org.apache.zookeeper:zookeeper > 3.9.0 , <= 3.9.5 3.9.5
– org.apache.zookeeper:zookeeper > 3.8.0 , <= 3.8.6 3.8.6
– zookeeper > 3.9.0 , <= 3.9.5 3.9.5
apache zookeeper > 3.8.0 , <= 3.8.6 –
apache zookeeper > 3.9.0 , <= 3.9.5 –
Original title
Apache ZooKeeper has improper handling of configuration values
Original description
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Vulnerability type
CWE-532 Insertion of Sensitive Information into Log File
Published: 7 Mar 2026 · Updated: 13 Mar 2026 · First seen: 7 Mar 2026