CVE-2026-24281

highpriority · track · 30EPSS 0.006 · 51 %ileDEEUFRRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.65% (51st) EPSS

CVSS 7.4 · high

Is it mine?

20 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–7.4

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 2.2 · impact 5.2

v3.17.4highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondaryexploitability 2.2 · impact 3.6

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 2.2 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-295USCWE-295USCWE-295USCWE-297USCWE-350USCWE-350US

affected products (20)

Products and version ranges known to be affected.

IBM Storage Scale <5.2.3.8all versionscert_bundDE
IBM Storage Scale <6.0.1.0all versionscert_bundDE
IBM Tivoli Network Manager IP Edition <4.2.0.24all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
IBM Storage Scale< 5.2.3.8cert_bundDE
IBM Storage Scale< 6.0.1.0cert_bundDE
IBM Tivoli Network Manager≤ IP Edition <4.2.0.24cert_bundDE
Apache Software Foundation Apache ZooKeeper≤ 3.8.0 ≤3.8.5enisa_euvdEU
Apache Software Foundation Apache ZooKeeper≤ 3.9.0 ≤3.9.4enisa_euvdEU
Apache Software Foundation ZooKeeper3.8.0 → 3.8.5fstec_bduRU
Apache Software Foundation ZooKeeper3.9.0 → 3.9.4fstec_bduRU
АО «СберТех» Platform V IAM SE≤ 2.3.1fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 8.0fstec_bduRU
apache zookeeper3.8.0 → 3.8.6nvdUScpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
apache zookeeper3.9.0 → 3.9.5nvdUScpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*
Bitnami zookeeper3.8.0 → 3.8.6osvUSpkg:bitnami/zookeeper
Bitnami zookeeper3.9.0 → 3.9.5osvUSpkg:bitnami/zookeeper
Maven org.apache.zookeeper:zookeeper3.8.0 → 3.8.6osvUSpkg:maven/org.apache.zookeeper/zookeeper
Maven org.apache.zookeeper:zookeeper3.9.0 → 3.9.5osvUSpkg:maven/org.apache.zookeeper/zookeeper

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1032IBM Tivoli Network Manager: Mehrere SchwachstellenDeutsch2026-04-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
GHSA-7xrh-hqfc-g7qrApache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager2026-03-07ghsa · osvUS
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
BIT-zookeeper-2026-24281Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager2026-03-10vendor · osvUS
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd certfr NVD CVE.org MITRE

published 2026-03-07modified 2026-07-15

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan