https://seclists.org/oss-sec/2026/q3/789: CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

Q: What access does an attacker need to exploit this issue?

The attacker does not need to authenticate. They need to be able to send a crafted add_auth("ensemble", ...) request to the affected ZooKeeper service.

Q: What is the practical impact of successful exploitation?

An attacker can insert arbitrary fake entries into ZooKeeper's operational log, including chosen timestamps, log levels, class names, and messages. The forged entries can appear visually indistinguishable from legitimate ZooKeeper log output.

Q: How can I tell whether my deployment is affected?

Deployments using org.apache.zookeeper:zookeeper versions 3.8.0 through 3.8.6 or 3.9.0 through 3.9.5 are affected. The issue is triggered when an ensemble name in a crafted request does not match and contains newline characters.

Q: What should I do to remediate the issue?

Upgrade ZooKeeper to version 3.8.7 or 3.9.6. These versions contain the fix.

Published Sep 15, 2026

Updated

Affected Software

2 affected components

Apache Zookeeper>=3.9.0<=3.9.5

Apache Zookeeper>=3.8.0<=3.8.6

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker does not need to authenticate. They need to be able to send a crafted add_auth("ensemble", ...) request to the affected ZooKeeper service.

What is the practical impact of successful exploitation?

An attacker can insert arbitrary fake entries into ZooKeeper's operational log, including chosen timestamps, log levels, class names, and messages. The forged entries can appear visually indistinguishable from legitimate ZooKeeper log output.

How can I tell whether my deployment is affected?

Deployments using org.apache.zookeeper:zookeeper versions 3.8.0 through 3.8.6 or 3.9.0 through 3.9.5 are affected. The issue is triggered when an ensemble name in a crafted request does not match and contains newline characters.

What should I do to remediate the issue?

Upgrade ZooKeeper to version 3.8.7 or 3.9.6. These versions contain the fix.