CVE-2026-24308
Information disclosure via improper handling of configuration values
CVE-2026-24308: Information disclosure via improper handling of configuration values. Not in the CISA KEV catalog. Low advisory severity (CVSS 3.3, Red Hat).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when Apache publishes the next one.
VulniPulse checks Apache's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2026-24308 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Low
- CVSS base score
- 3.3 (Red Hat)
- Weakness
- CWE-117
- Fixed releases
- Apache: 3.8.6, 3.9.5
- Red Hat: RHSA-2026:14276
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-24308; bulletin-wide values are not repeated here.
Is CVE-2026-24308 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-24308 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-24308?
Upgrade to a fixed release named by the vendor:
- Apache: 3.8.6, 3.9.5
- Red Hat: RHSA-2026:14276
- Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue. (Apache)
- Update the affected package(s) to the fixed version shipped in RHSA-2026:14276 (`sudo dnf update` / `yum update`). (Red Hat)
Vendor advisory comparison
Apache
1 advisory- Advisory severityUnrated
Advisory [CVE-2026-24308] Apache ZooKeeper: Sensitive information disclosure in client configuration handling
CVE-2026-24308Source published Source updated
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
- Affected products in this advisory
- Apache ZooKeeper
- Source-reported affected versions
- Apache ZooKeeper 3.9.0 through 3.9.4
- Apache ZooKeeper 3.8.0 through 3.8.5
- Source-reported fixed versions
- 3.8.6
- 3.9.5
- Mitigation guidance
- Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Red Hat
1 advisory- Advisory severityLow3.3
Low [CVE-2026-24308] Information disclosure via improper handling of configuration values
CVE-2026-24308Source published
Information disclosure via improper handling of configuration values. Red Hat rates this important (CVSS 3.3). Weakness: CWE-117. Affected package(s): zookeeper, rhoai/odh-modelmesh-rhel9:1776756834. Resolved in Red Hat advisory RHSA-2026:14276 — update the affected packages (`sudo dnf update`).
- Affected products in this advisory
- Red Hat OpenShift AI 2.25
- Red Hat build of Debezium 2
- Red Hat build of Debezium 3
- Red Hat Fuse 7
3 more entries in the full advisory.
- Source-reported affected versions
- zookeeper
- rhoai/odh-modelmesh-rhel9:1776756834
- Source-reported fixed versions
- RHSA-2026:14276
- Mitigation guidance
- Update the affected package(s) to the fixed version shipped in RHSA-2026:14276 (`sudo dnf update` / `yum update`).
More Apache advisories
- CVE-2026-84501Sep 16, 2026unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's
- CVE-2026-84439Sep 16, 2026When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker
- CVE-2026-79993Sep 16, 2026Apache ZooKeeper: The `deleteContainer` opcode (0x14/20) is processed without verifying
- CVE-2026-59969Sep 16, 2026Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode
- CVE-2026-59739Sep 16, 2026Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing
- CVE-2026-24281Mar 7, 2026Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper
Follow CVE-2026-24308 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.