Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

Add IAVM ID - Multiple Vulnerabilities in Apache ZooKeeper

The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.6 or 3.9.x prior to 3.9.5. It is, therefore, affected by multiple vulnerabilities:

  - Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive     information stored in client configuration in the client's logfile. Configuration values are     exposed at INFO level logging, rendering potential production systems affected by the issue.
    (CVE-2026-24308)

  - Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR)     when IP SAN validation fails, allowing attackers who control or spoof PTR records to     impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. Note     that an attacker must present a certificate which is trusted by ZKTrustManager, which makes     the attack vector harder to exploit. (CVE-2026-24281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN
    validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or
    clients with a valid certificate for the PTR name. It's important to note that attacker must present a
    certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are
    recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new
    configuration option to disable reverse DNS lookup in client and quorum protocols. (CVE-2026-24281)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN     validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or     clients with a valid certificate for the PTR name. It's important to note that attacker must present a     certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are     recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new     configuration option to disable reverse DNS lookup in client and quorum protocols. (CVE-2026-24281)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
301976	Apache ZooKeeper 3.8.x < 3.8.6 / 3.9.x < 3.9.5 Multiple Vulnerabilities	Nessus	Misc.	high
438625	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-7xrh-hqfc-g7qr)	Tenable Cloud Security	SCA Checks	high
438625	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-7xrh-hqfc-g7qr)	Tenable Self-Hosted Container Security	SCA Checks	high
301660	Linux Distros Unpatched Vulnerability : CVE-2026-24281	Nessus	Misc.	high

Detections

Analytics

CVE-2026-24281

high

Tenable Plugins

Coming Soon

high

high

high

high