Skip to content
fr Sign in
Not rated

CVE-2026-84501 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a…

Description

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache ZooKeeper 3.9 3.9.0 → 3.9.5 No fix stated
Apache ZooKeeper 3.8 3.8.0 → 3.8.6 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache ZooKeeper

The 19 CVEs of Apache ZooKeeper →
CVE-2026-100302 Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling 7.1 High CVE-2026-115448 Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable 8.7 High CVE-2026-100300 Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread 8.7 High CVE-2026-100252 Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID 8.6 High
Track this CVE