Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Vulnerability

Description CVE-2026-24308 is an information disclosure vulnerability in Apache ZooKeeper's ZKConfig component. The flaw arises from improper handling of configuration values, which are logged at INFO level logging, thereby exposing sensitive data such as credentials or API keys to anyone with access to the client log files. This affects ZooKeeper versions 3.8.0 through 3.8.5 and 3.9.0 through 3.9.4 on all platforms [1][2].

Exploitation

Conditions An attacker does not need network-level access; local access to log files or a log aggregation system that collects ZooKeeper client logs is sufficient. The sensitive data is written during normal operation, so no special user interaction or elevated privileges beyond read access to logs are required. The vulnerability is considered important due to the potential for broad impact in production environments where logging is commonly enabled [1][2].

Impact

Successful exploitation results in the disclosure of sensitive configuration details, which can be leveraged to compromise other systems or gain unauthorized access. The severity is amplified in environments where credentials or tokens are stored in client configurations [1][2].

Mitigation

The vulnerability is fixed in Apache ZooKeeper versions 3.8.6 and 3.9.5. Users are strongly advised to upgrade to these patched versions. As a workaround, administrators can restrict access to log files or reduce logging verbosity, though upgrading is the recommended course of action [3][4].