Bug 2445451 (CVE-2026-24308)

Summary:	CVE-2026-24308 Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asoldano, ataylor, bbaranow, bmaxwell, brian.stansberry, bstansbe, caswilli, ccranfor, chfoley, darran.lofthouse, dbruscin, dlofthou, dosoudil, fjuma, fmariani, gmalinko, istudens, ivassile, iweiss, janstey, jkoehler, jpechane, kaycoth, kvanderr, lphiri, mosmerov, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rgodfrey, rstancel, rstepani, smaestri, swoodman, tcunning, thjenkin, tom.jenkinson, vdosoudi, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client's logfile. This vulnerability can lead to information disclosure, potentially revealing critical system details to unauthorized parties.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-07 09:01:26 UTC

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Comment 2 errata-xmlrpc 2026-04-16 15:32:26 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.0

Via RHSA-2026:8509 https://access.redhat.com/errata/RHSA-2026:8509

Comment 3 errata-xmlrpc 2026-05-06 17:59:03 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.5

Via RHSA-2026:14272 https://access.redhat.com/errata/RHSA-2026:14272

Comment 4 errata-xmlrpc 2026-05-06 18:00:04 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.12.7

Via RHSA-2026:14276 https://access.redhat.com/errata/RHSA-2026:14276