CVE-2026-24308

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532CWE-117

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-243096.4Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP functCVE-2026-24316.1The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date_from' and 'date_to' parameters in aCVE-2026-243104.3Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP functCVE-2026-243115.6The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversibleCVE-2026-243125.2An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass rolCVE-2026-243135.0SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated useCVE-2026-243144.3Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be CVE-2026-243154.2SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by CVE-2026-243166.4SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary inteCVE-2026-243175.0SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploCVE-2026-243184.2Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker coulCVE-2026-243195.8In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this inf
CVE-2026-24308: High severity, CVSS 7.5 | Vulnix