PT-2026-23853 · Apache · Apache Zookeeper

Youlong Chen · Publicado 2026-01-01 · Atualizado 2026-05-18 · CVE-2026-24308

Positive Technologies (AI Summary) · Pt

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Nome do Software Vulnerável e Versões Afetadas Apache ZooKeeper versões 3.8.5 e 3.9.4

Descrição Existe uma falha no Apache ZooKeeper na qual o tratamento inadequado de valores de configuração no ZKConfig pode levar à exposição de informações sensíveis. Especificamente, dados de configuração do cliente armazenados no arquivo de log do cliente podem ser revelados a um atacante. Isso ocorre porque os valores de configuração são registrados em log no nível INFO, impactando potencialmente sistemas de produção.

Recomendações Atualize para a versão 3.8.6 ou 3.9.5 do Apache ZooKeeper para resolver este problema.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

BIT-ZOOKEEPER-2026-24308

CLEANSTART-2026-AO61361

CLEANSTART-2026-CF62516

CLEANSTART-2026-EZ90321

CLEANSTART-2026-IS05941

CLEANSTART-2026-JK47870

CLEANSTART-2026-JU62349

CLEANSTART-2026-KV09488

CLEANSTART-2026-LO22603

CLEANSTART-2026-RD06185

CLEANSTART-2026-SQ91016

CLEANSTART-2026-SV95049

CLEANSTART-2026-WK99982

CVE-2026-24308

GHSA-CRHR-QQJ8-RPXC

Produtos afetados

Apache Zookeeper

Referências · 275

• https://github.com/apache/zookeeper/releases/tag/release-3.8.6 · Nota
• https://github.com/apache/zookeeper · Nota
• https://github.com/apache/zookeeper/releases/tag/release-3.9.5 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AO61361.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RD06185.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KV09488.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SQ91016.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CF62516.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LO22603.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JU62349.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JK47870.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SV95049.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WK99982.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EZ90321.json · Nota