Vulnerability · Published Sep 16, 2026 · Assigned by apache
CVE-2026-84501Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
Medium 5.3
In plain English
A medium-severity security flaw in Apache ZooKeeper from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | zookeeper | no fix listed | DEBIAN-CVE-2026-84501 |
| Debian:13 | zookeeper | no fix listed | DEBIAN-CVE-2026-84501 |
| Debian:14 | zookeeper | 3.9.6-1 | DEBIAN-CVE-2026-84501 |
| Ubuntu:22.04:LTS | zookeeper | no fix listed | UBUNTU-CVE-2026-84501 |
| Ubuntu:24.04:LTS | zookeeper | no fix listed | UBUNTU-CVE-2026-84501 |
| Ubuntu:26.04:LTS | zookeeper | no fix listed | UBUNTU-CVE-2026-84501 |
| Ubuntu:26.10 | zookeeper | no fix listed | UBUNTU-CVE-2026-84501 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ZooKeeper | 3.9.0 – through 3.9.53.8.0 – through 3.8.6 |
Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N