REDHAT-BUG-2535096: Medium severity Apache Zookeeper vulnerability

Q: What does an attacker need to exploit this issue?

The attacker must be able to send a crafted add_auth("ensemble", ...) request to ZooKeeper. No authentication is required, and the supplied ensemble name must not match so that it is logged by EnsembleAuthenticationProvider.handleAuthentication().

Q: Which ZooKeeper releases are affected, and what versions fix the issue?

Affected releases are ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. Upgrade to 3.8.7 or 3.9.6 to remediate the issue.

Q: How can I determine whether an instance is vulnerable?

Check the ZooKeeper version in use. Instances running versions in the affected 3.8.x or 3.9.x ranges are affected; instances upgraded to 3.8.7 or 3.9.6 are fixed.

Published Sep 16, 2026

Updated

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.

This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.

Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

Affected Software

1 affected component

Apache Zookeeper>=3.9.0<=3.9.5, >=3.8.0<=3.8.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache ZooKeeper to a version that resolves this vulnerability.
Fixed in 3.8.7
Upgrade
Upgrade Apache ZooKeeper to a version that resolves this vulnerability.
Fixed in 3.9.6

Event History

Sep 16, 2026

Data Sourced

via Red Hat·09:49 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must be able to send a crafted add_auth("ensemble", ...) request to ZooKeeper. No authentication is required, and the supplied ensemble name must not match so that it is logged by EnsembleAuthenticationProvider.handleAuthentication().

Which ZooKeeper releases are affected, and what versions fix the issue?

Affected releases are ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. Upgrade to 3.8.7 or 3.9.6 to remediate the issue.

How can I determine whether an instance is vulnerable?

Check the ZooKeeper version in use. Instances running versions in the affected 3.8.x or 3.9.x ranges are affected; instances upgraded to 3.8.7 or 3.9.6 are fixed.

REDHAT-BUG-2535096: Medium severity Apache Zookeeper vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which ZooKeeper releases are affected, and what versions fix the issue?

How can I determine whether an instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which ZooKeeper releases are affected, and what versions fix the issue?

How can I determine whether an instance is vulnerable?