CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the audit log uses tab-separated key=value format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting result=success), forge operation types, and corrupt forensic evidence.
A log injection vulnerability in Apache ZooKeeper allows a client that can call setACL to inject forged key-value fields into zookeeperaudit.log. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the acl= audit field without escaping tab characters. Because audit events are emitted as tab-separated key=value records, a crafted ACL id can make one successful setAcl event appear to contain forged fields such as operation=delete and znode=/forged. This undermines the integrity of downstream audit parsing, alerting, and incident response.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.6 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.8.7 - Configuration
Disable audit logging by setting zookeeper.audit.enable=false to prevent forged fields from being written to zookeeper_audit.log.
Apache ZooKeeper zookeeper.audit.enable = false
Event History
Frequently Asked Questions
Which deployments are affected?
Apache ZooKeeper versions 3.9.0 through 3.9.5 and 3.8.0 through 3.8.6 are affected. The issue applies when audit logging is enabled with zookeeper.audit.enable=true.
What access does an attacker need?
An attacker does not need to authenticate to exploit the digest-authentication request path. A client able to call setACL can also inject forged fields through attacker-controlled digest ACL IDs.
What is the practical impact on audit operations?
Crafted tab characters can create additional apparent key=value fields in tab-separated audit records, including forged result, operation, or znode values. This can corrupt downstream parsing, alerting, and incident-response evidence rather than altering the underlying logged operation.