Cloudanix VulnDB

CVE-2026-24308

High · 7.5

CVSS

7.5

EPSS

1.2%

Published

Mar 7, 2026

CISA due date

—

The record

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard akhq 0 0.26.0-r11
Chainguard apache-activemq-artemis 0 2.53.0-r2
Chainguard apache-nifi 0 2.8.0-r4
Chainguard apache-pulsar-4.0 0 4.0.9-r6
Chainguard apache-pulsar-4.1 0 4.1.3-r7
Chainguard apache-pulsar-fips-4.0 0 4.0.9-r6
Chainguard apache-pulsar-fips-4.1 0 4.1.3-r7
Chainguard druid 0 36.0.0-r5
Chainguard kafka-3.8 0 3.8.1-r53
Chainguard kafka-3.9 0 3.9.2-r4
Chainguard kserve-modelmesh 0 0.12.0-r26
Chainguard pinot 0 1.4.0-r3
Chainguard seata-server 0 2.6.0-r4
Chainguard solr 0 10.0.0-r1
Chainguard spark-3.5-scala-2.12 0 3.5.8-r6
Chainguard spark-3.5-scala-2.13 0 3.5.8-r6
Chainguard spark-4.0-scala-2.13 0 4.0.2-r7
Chainguard spark-4.1-scala-2.13 0 4.1.1-r7
Chainguard spark-fips-3.5-scala-2.12 0 3.5.4-r25
Chainguard spark-fips-3.5-scala-2.13 0 3.5.4-r25
Chainguard spark-fips-4.1-scala-2.13 0 4.1.1-r3
Chainguard spark-kubernetes-operator 0 0.7.0-r4
Chainguard spark-kubernetes-operator-fips 0 0.7.0-r2
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.51.0-r1
Chainguard tez 0 0.10.5-r8
Chainguard thingsboard-tb-mqtt-transport 0 4.3.1-r1
Chainguard thingsboard-tb-node 0 4.3.1-r1
Chainguard trino-plugin-kafka 0 480-r0
Chainguard trino-plugin-kafka-event-listener 0 480-r0
Chainguard trino-plugin-pinot 0 480-r0
Chainguard trino-plugin-ranger 0 480-r0
Chainguard zookeeper-3.9 0 3.9.5-r0
Chainguard zookeeper-fips-3.9 0 3.9.5-r0
Wolfi akhq 0 0.26.0-r11
Wolfi apache-activemq-artemis 0 2.53.0-r2
Wolfi apache-nifi 0 2.8.0-r4
Wolfi apache-pulsar-4.1 0 4.1.3-r7
Wolfi druid 0 36.0.0-r5
Wolfi kafka-3.8 0 3.8.1-r53
Wolfi kafka-3.9 0 3.9.2-r4
Wolfi kserve-modelmesh 0 0.12.0-r26
Wolfi solr 0 10.0.0-r1
Wolfi spark-3.5-scala-2.12 0 3.5.8-r6
Wolfi spark-3.5-scala-2.13 0 3.5.8-r6
Wolfi spark-4.0-scala-2.13 0 4.0.2-r7
Wolfi spark-4.1-scala-2.13 0 4.1.1-r7
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.51.0-r1
Wolfi tez 0 0.10.5-r8
Wolfi thingsboard-tb-mqtt-transport 0 4.3.1-r1
Wolfi thingsboard-tb-node 0 4.3.1-r1
Wolfi trino-plugin-kafka 0 480-r0
Wolfi trino-plugin-kafka-event-listener 0 480-r0
Wolfi trino-plugin-pinot 0 480-r0
Wolfi trino-plugin-ranger 0 480-r0
Wolfi zookeeper-3.9 0 3.9.5-r0

Related vulnerabilities