In ZooKeeper 3.8.5 and 3.9.4 the configuration reader transparently writes client configuration values to log files at INFO level. When a client starts, the configuration file is parsed and the values, which may include passwords or other secrets, are logged without masking. The resulting logs contain sensitive information that can be read by any party with access to the log files, thereby leaking credentials and other confidential data. This flaw represents a straightforward confidentiality breach arising from improper logging practice.

All platforms running Apache ZooKeeper version 3.8.5 or 3.9.4 are affected. The vulnerability is present in the generic ZooKeeper client, so any installation that includes the client component and writes logs will be impacted. Affected versions are 3.8.5 and 3.9.4; the fix is available in 3.8.6 and 3.9.5.

The CVSS score of 6.5 indicates a medium severity vulnerability. EPSS indicates an exploitation likelihood of less than 1%, suggesting a low probability of public exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalog. The exploitation vector is likely local or involves an attacker who can influence client configuration or has access to the log files, because the sensitive data is only written to logs during normal client startup and logging is performed at INFO level.