StackRadar

CVE-2026-24281

High

Advisory

Published 7 Mar 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.006
48th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
41
of 17,781 indexed, latest versions
Container images
44
deployed by those charts
Fix available
3 of 3
affected packages

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Carried by container images the latest versions of 41 of 17,781 indexed charts deploy, on 44 images.

Affected packageAffected versionsFixed inImages
zookeepermaven3.8.1, 3.8.2, 3.8.3, 3.8.4+4 more3.8.6, 3.9.544
Apache ZooKeeperbitnami3.9.03.8.61
zookeeperbitnami3.8.1-13.8.61
OSV records
BIT-zookeeper-2026-24281GHSA-7xrh-hqfc-g7qr

Charts affected

41 by stars
ChartLatestAffected imagesRadar Score
milvusmilvus-helm5.0.271 of 4See more

milvus milvus-helm 5.0.27

1 of the 4 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
zookeeper@3.9.2
3.9.5

Open the chart page →

10,670
kafkakubelauncherVerified publisher0.1.261 of 1See more

kafka kubelauncher 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/kafkadigest-pinned43e1085cd0a8
zookeeper@3.8.4
3.8.6

Open the chart page →

1,360
zookeeperkubelauncherVerified publisher0.2.111 of 1See more

zookeeper kubelauncher 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/zookeeperdigest-pinned7826e9caa461
zookeeper@3.9.3
3.9.5

Open the chart page →

989
kafkakafka18.0.11 of 1See more

kafka kafka 18.0.1

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
kafkace/kafka:v3.7.1-63ba8d27adc206bf5a4
zookeeper@3.8.4
3.8.6

Open the chart page →

3,395
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
zookeeper@3.8.3
3.8.6

Open the chart page →

7,930
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
zookeeper@3.9.3
3.9.5
apache/hertzbeat-collector:1.8.0a2bab1be574c
zookeeper@3.9.3
3.9.5

Open the chart page →

14,000
thingsboardcetic0.1.21 of 2See more

thingsboard cetic 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
thingsboard/tb-postgres:latest2d17e4e36edc
zookeeper@3.9.3
3.9.5

Open the chart page →

5,235
flyte-binaryflyte2.0.481 of 4See more

flyte-binary flyte 2.0.48

1 of the 4 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
zookeeper@3.9.4
3.9.5

Open the chart page →

4,641
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.262 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

2 of the 6 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
Apache ZooKeeper@3.9.0
zookeeper@3.9.0
3.8.6
3.9.5
thingsboard/tb-node:3.6.0f40a542832c4
zookeeper@3.8.1
3.8.6

Open the chart page →

14,566
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
bitnamilegacy/zookeeper:3.8.1-debian-11-r6dba59d740e13
zookeeper@3.8.1-1
zookeeper@3.8.1
3.8.6
3.8.6

Open the chart page →

17,877
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
zookeeper@3.8.4
3.8.6

Open the chart page →

7,740
nifid4nVerified publisher2.0.01 of 5See more

nifi d4n 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
zookeeper@3.9.2
3.9.5

Open the chart page →

5,398
enavenav-service-architectureVerified publisher0.0.74 of 10See more

enav enav-service-architecture 0.0.7

4 of the 10 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/kafka:3.9.0fbc7d7c428e3
zookeeper@3.8.4
3.8.6
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
zookeeper@3.8.4
3.8.6
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
zookeeper@3.8.4
3.8.6
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
zookeeper@3.8.4
3.8.6

Open the chart page →

15,860
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.31 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.4.4c0224a1adf7a
zookeeper@3.8.3
3.8.6

Open the chart page →

15,562
gridgaingridgainOfficialVerified publisher1.0.61 of 1See more

gridgain gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
gridgain/community:8.9.11d32d182a0e6a
zookeeper@3.8.4
3.8.6

Open the chart page →

4,679
kafka-kraft-on-k8skafka-kraft-on-k8sVerified publisher1.1.03 of 3See more

kafka-kraft-on-k8s kafka-kraft-on-k8s 1.1.0

3 of the 3 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
kafkakraft/kafka-connect:3.7.0062d697db7e5
zookeeper@3.8.3
3.8.6
kafkakraft/kafka-controller:3.7.0f261ad288fce
zookeeper@3.8.3
3.8.6
kafkakraft/kafkakraft:3.7.02e4b593b878b
zookeeper@3.8.3
3.8.6

Open the chart page →

14,130
drillmagasin-drill0.9.01 of 3See more

drill magasin-drill 0.9.0

1 of the 3 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
merlos/zookeeper:3.9.3a38fc7e09ed7
zookeeper@3.9.3
3.9.5

Open the chart page →

5,734
data-prepperopensearch-project-helm-chartsVerified publisher0.3.11 of 1See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
opensearchproject/data-prepper:2.8.057c25fa01d3c
zookeeper@3.8.4
3.8.6

Open the chart page →

1,692
opikopikOfficialVerified publisher2.2.591 of 13See more

opik opik 2.2.59

1 of the 13 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
library/zookeeper:3.9.4dfa9ba46d14b
zookeeper@3.9.4
3.9.5

Open the chart page →

14,334
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.6.683dbca3efd2a
zookeeper@3.8.4
3.8.6

Open the chart page →

16,449
active-mqactivemq-helm-chartVerified publisher1.8.21 of 3See more

active-mq activemq-helm-chart 1.8.2

1 of the 3 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.44.00305c26f19ed
zookeeper@3.9.4
3.9.5

Open the chart page →

3,188
akto-mini-testing-kafkaakto1.42.12 of 5See more

akto-mini-testing-kafka akto 1.42.1

2 of the 5 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
zookeeper@3.8.4
3.8.6
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
zookeeper@3.8.4
3.8.6

Open the chart page →

6,397
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
zookeeper@3.8.4
3.8.6

Open the chart page →

2,453
nifi-registryd4nVerified publisher1.0.01 of 2See more

nifi-registry d4n 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
zookeeper@3.9.2
3.9.5

Open the chart page →

5,398
infrafibonacci-cluster-infraVerified publisher1.0.01 of 4See more

infra fibonacci-cluster-infra 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.37.0bae523439ee3
zookeeper@3.9.2
3.9.5

Open the chart page →

12,454
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
zookeeper@3.9.4
3.9.5

Open the chart page →

3,463
galoy-depsgaloymoney0.10.201 of 9See more

galoy-deps galoymoney 0.10.20

1 of the 9 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.39.002f6f143fc6d
zookeeper@3.8.3
3.8.6

Open the chart page →

11,961
galoy-depsgaloymoney20.10.201 of 9See more

galoy-deps galoymoney2 0.10.20

1 of the 9 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.39.002f6f143fc6d
zookeeper@3.8.3
3.8.6

Open the chart page →

11,961
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-kafka071a788162e8
zookeeper@3.8.3
3.8.6

Open the chart page →

49,025
ckanhelmforgeVerified publisher1.3.81 of 6See more

ckan helmforge 1.3.8

1 of the 6 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
zookeeper@3.9.3
3.9.5

Open the chart page →

9,920
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
library/zookeeper:3.8-temurin55d1e5b2e601
zookeeper@3.8.2
3.8.6

Open the chart page →

37,671
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
zookeeper@3.9.2
3.9.5

Open the chart page →

5,320
metabase-k8smetabase-k8s1.0.01 of 1See more

metabase-k8s metabase-k8s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
metabase/metabase:v0.53.4.17807bc5cad17
zookeeper@3.8.3
3.8.6

Open the chart page →

2,589
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
zookeeper@3.8.1
3.8.6

Open the chart page →

9,005
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
zookeeper@3.9.3
3.9.5

Open the chart page →

6,338
trinopresto-loadbalancer0.2.101 of 2See more

trino presto-loadbalancer 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
trinodb/trino:4796af989b0846d
zookeeper@3.9.4
3.9.5

Open the chart page →

2,264
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
zookeeper@3.8.4
3.8.6

Open the chart page →

21,211
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
zookeeper@3.8.3
3.8.6

Open the chart page →

5,269
strimzi-user-operatorspartan0.4.01 of 1See more

strimzi-user-operator spartan 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.45.158c727cd2e68
zookeeper@3.8.4
3.8.6

Open the chart page →

1,836
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
zookeeper@3.8.4
3.8.6

Open the chart page →

1,733
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-24281.

Container imageDigestPackageFixed in
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
Apache ZooKeeper@3.9.0
zookeeper@3.9.0
3.8.6
3.9.5

Open the chart page →

9,397

Container images carrying it

44 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
apache/nifi-registry:1.26.07cdfd8deec92
zookeeper@3.9.2
3.9.5
2
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
Apache ZooKeeper@3.9.0
zookeeper@3.9.0
3.8.6
3.9.5
2
confluentinc/cp-zookeeper:latest7610a50b13e7
zookeeper@3.8.4
3.8.6
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
zookeeper@3.9.4
3.9.5
2
quay.io/strimzi/operator:0.39.002f6f143fc6d
zookeeper@3.8.3
3.8.6
2
apache/activemq-artemis:2.44.00305c26f19ed
zookeeper@3.9.4
3.9.5
1
apache/activemq-artemis:2.37.0bae523439ee3
zookeeper@3.9.2
3.9.5
1
apache/druid:29.0.10cef139b6bf1
zookeeper@3.8.3
3.8.6
1
apache/hertzbeat:1.8.075d48a62748f
zookeeper@3.9.3
3.9.5
1
apache/hertzbeat-collector:1.8.0a2bab1be574c
zookeeper@3.9.3
3.9.5
1
apache/kafka:3.9.0fbc7d7c428e3
zookeeper@3.8.4
3.8.6
1
apache/nifi-registry:1.27.063b8e3e40742
zookeeper@3.9.2
3.9.5
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
zookeeper@3.8.1
3.8.6
1
apachepulsar/pulsar:3.0.79c9947de139d
zookeeper@3.9.2
3.9.5
1
apache/ranger:2.7.076c176e8a0e4
zookeeper@3.8.4
3.8.6
1
bitnamilegacy/zookeeper:3.8.1-debian-11-r6dba59d740e13
zookeeper@3.8.1-1
zookeeper@3.8.1
3.8.6
3.8.6
1
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
zookeeper@3.9.3
3.9.5
1
confluentinc/cp-kafka:7.6.683dbca3efd2a
zookeeper@3.8.4
3.8.6
1
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
zookeeper@3.8.4
3.8.6
1
confluentinc/cp-kafka:7.4.4c0224a1adf7a
zookeeper@3.8.3
3.8.6
1
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
zookeeper@3.8.3
3.8.6
1
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
zookeeper@3.8.4
3.8.6
1
gridgain/community:8.9.11d32d182a0e6a
zookeeper@3.8.4
3.8.6
1
kafkace/kafka:v3.7.1-63ba8d27adc206bf5a4
zookeeper@3.8.4
3.8.6
1
kafkakraft/kafka-connect:3.7.0062d697db7e5
zookeeper@3.8.3
3.8.6
1
kafkakraft/kafka-controller:3.7.0f261ad288fce
zookeeper@3.8.3
3.8.6
1
kafkakraft/kafkakraft:3.7.02e4b593b878b
zookeeper@3.8.3
3.8.6
1
library/zookeeper:3.8-temurin55d1e5b2e601
zookeeper@3.8.2
3.8.6
1
library/zookeeper:3.9.4dfa9ba46d14b
zookeeper@3.9.4
3.9.5
1
merlos/zookeeper:3.9.3a38fc7e09ed7
zookeeper@3.9.3
3.9.5
1
metabase/metabase:v0.53.4.17807bc5cad17
zookeeper@3.8.3
3.8.6
1
opensearchproject/data-prepper:2.8.057c25fa01d3c
zookeeper@3.8.4
3.8.6
1
thingsboard/tb-node:3.6.0f40a542832c4
zookeeper@3.8.1
3.8.6
1
thingsboard/tb-postgres:latest2d17e4e36edc
zookeeper@3.9.3
3.9.5
1
trinodb/trino:45038c6f24ab1a4
zookeeper@3.8.4
3.8.6
1
trinodb/trino:4796af989b0846d
zookeeper@3.9.4
3.9.5
1
vespaengine/vespa:8.526.1569b160f58211
zookeeper@3.9.3
3.9.5
1
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
zookeeper@3.8.4
3.8.6
1
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
zookeeper@3.8.4
3.8.6
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
zookeeper@3.8.4
3.8.6
1
ghcr.io/kubelauncher/kafka43e1085cd0a8
zookeeper@3.8.4
3.8.6
1
ghcr.io/kubelauncher/zookeeper7826e9caa461
zookeeper@3.9.3
3.9.5
1
ghcr.io/open-telemetry/demo:1.12.0-kafka071a788162e8
zookeeper@3.8.3
3.8.6
1
quay.io/strimzi/operator:0.45.158c727cd2e68
zookeeper@3.8.4
3.8.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.