CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.8.7 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.6
Event History
Frequently Asked Questions
Which deployments are affected?
Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 are affected. The issue is fixed in versions 3.8.7 and 3.9.6.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They need to send a crafted add_auth("ensemble", ...) request whose ensemble name contains newline characters and does not match the expected ensemble name.
What is the practical impact?
An attacker can insert fake operational-log entries that appear indistinguishable from legitimate ZooKeeper output, including arbitrary apparent timestamps, log levels, class names, and messages. This can undermine log-based monitoring, incident investigation, and audit records.
What should teams do if they cannot upgrade immediately?
The provided information recommends upgrading to 3.8.7 or 3.9.6 and does not specify an alternative mitigation. Treat operational-log entries from affected versions as potentially forged when investigating events.