An unauthenticated attacker can inject arbitrary tab‑separated key=value fields into ZooKeeper’s audit log when audit logging is enabled, which subverts the integrity of audit data and can create forged operation records such as result=success or operation=delete. The flaw arises because the server does not sanitize tab characters in the ACL identifier, allowing an attacker to craft a setACL request that produces audit entries with forged fields. This vulnerability (CWE‑117) undermines forensic evidence and downstream alerting mechanisms.

The flaw impacts Apache Software Foundation's Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. Users should update to the latest released version, 3.9.6 or 3.8.7, which removes the insecure handling of tab characters in audit log entries.

The vulnerability is exploitable by any client with permission to perform a setACL operation and requires that audit logging be enabled. An attacker does not need prior authentication, and the attack vector is a network request to a ZooKeeper server. The EPSS score of < 1% indicates a very low probability of exploitation, while the vulnerability is not listed in CISA KEV. Nonetheless, the potential to fabricate audit data presents a high integrity risk, especially for environments that rely on audit logs for compliance or incident response.