CVE-2026-24281 describes a security vulnerability in Apache ZooKeeper's ZKTrustManager where hostname verification falls back to reverse DNS resolution (PTR) if IP SAN validation fails. Attackers who can control or spoof PTR records may impersonate ZooKeeper servers or clients by presenting a valid certificate trusted by ZKTrustManager for the PTR name. This fallback reliance on reverse DNS for security-critical decisions constitutes CWE-350. The vulnerability is mitigated by upgrading to Apache ZooKeeper versions 3.8.6 or 3.9.5, which introduce a configuration option to disable reverse DNS lookups in client and quorum protocols.

An attacker able to spoof PTR records and present a trusted certificate for the PTR name can impersonate ZooKeeper servers or clients, potentially leading to unauthorized actions within the ZooKeeper environment. The vulnerability does not affect confidentiality or availability directly but impacts integrity by allowing impersonation. Exploitation requires the attacker to have a certificate trusted by ZKTrustManager, which raises the attack complexity. The CVSS 3.1 base score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity.

A fix is available by upgrading Apache ZooKeeper to versions 3.8.6 or 3.9.5, which add a configuration option to disable reverse DNS lookup in client and quorum protocols, thereby preventing reliance on potentially spoofed PTR records. Users should apply these updates to remediate the vulnerability. No other vendor advisories indicate alternative mitigations or that no action is required.