CLEANSTART-2026-OG07863: unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",
Security vulnerability affects the solr package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth("ensemble",.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 9.11.0-r2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker with network access to the affected Apache ZooKeeper service can attempt to exploit it; no credentials or user interaction are required.
What is the likely impact of exploitation?
An attacker can inject arbitrary fake lines into ZooKeeper's operational log. The provided severity vector indicates an integrity impact only, with no stated confidentiality or availability impact.
How can I determine whether my deployment is affected?
Review whether the cleanstart/solr package deployment exposes or permits network access to its Apache ZooKeeper service. The supplied data does not identify affected versions, fixed versions, or a specific detection method.