> CVE-2026-24308

« BACK_TO_HOME
PUBLISHED
2026-03-07 09:16
MODIFIED
2026-03-07 09:16
EPSS (Prob. Exploit)
1.20%
Top 32.1%
DATA SOURCES:
NVD 🔗 2026-03-07 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28 OSV 🔗 2026-03-14

> DESCRIPTION

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-532

> CWE DETAILED DESCRIPTIONS

CWE-532: Insertion of Sensitive Information into Log File - The product writes sensitive information to a log file.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat AMQ Broker 7.14.0 release and security update
Red Hat AMQ Broker 7.14.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Sy...
Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI.
Red Hat Security Advisory: Red Hat AMQ Broker 7.12.7 release and security update
Red Hat AMQ Broker 7.12.7 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Sy...
Red Hat Security Advisory: Red Hat AMQ Broker 7.13.5 release and security update
Red Hat AMQ Broker 7.13.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Sy...
Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update
Streams for Apache Kafka 2.9.4 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scorin...
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 XP 6.0.6.GA release
JBoss EAP XP 6.0.6.GA release on the EAP 8.1 base. See references for release notes.

> GITHUB SECURITY ADVISORY

GHSA-crhr-qqj8-rpxc HIGH

Apache ZooKeeper has improper handling of configuration values

AFFECTED PACKAGES:
MAVEN / org.apache.zookeeper:zookeeper
>= 3.8.0, < 3.8.6
Fixed in: 3.8.6
MAVEN / org.apache.zookeeper:zookeeper
>= 3.9.0, < 3.9.5
Fixed in: 3.9.5

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
14 versions affected
ALIASES:
BIT-zookeeper-2026-24308, GHSA-crhr-qqj8-rpxc

> HISTORIQUE DES MODIFICATIONS

Première apparition
07/03/2026 09:16
Source: NVD
📊 ENRICHISSEMENT 01/04/2026 06:02
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-532: Insertion of Sensitive Information into Log File - The product writes sensitive information to a log file.
Total des modifications: 1 Dernière mise à jour: 7 months ago

> REFERENCES

https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr
« BACK_TO_HOME