Description
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.

This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.

Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Published: 2026-09-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Log Forgery
Action: Patch Now
AI Analysis

Impact

An unauthenticated attacker can embed newline characters into an add_auth request to forge log entries. When the ensemble name does not match, the authentication provider logs the raw string via a warning call. Because SLF4J’s {} placeholder preserves newlines, the attacker may create forged log lines with arbitrary timestamps, levels, identical to genuine ZooKeeper output. This represents a log injection flaw (CWE‑117) allowing the attacker to obscure real events or inject misleading forensic data.

Affected Systems

Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 are affected. Versions 3.8.7 and 3.9.6 contain the vendor fix.

Risk and Exploitability

The CVSS score is not provided in the data. EPSS is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely by sending a crafted request and does not require elevated privileges. The impact is limited to log forgery, which can compromise forensic integrity but does not enable code execution or privilege escalation.

Generated by OpenCVE AI on September 16, 2026 at 13:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Apache ZooKeeper 3.8.7 or 3.9.6 to apply the vendor patch.
  • Restrict external network access to ZooKeeper or enable authentication to reduce exposure.
  • Apply additional firewall rules or network segmentation to further isolate ZooKeeper from untrusted networks.

Generated by OpenCVE AI on September 16, 2026 at 13:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache zookeeper
Vendors & Products Apache
Apache zookeeper

Wed, 16 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
References

Wed, 16 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
Description An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Title Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
Weaknesses CWE-117
References

Subscriptions

Apache Zookeeper
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-09-16T19:43:09.161Z

Reserved: 2026-09-01T20:56:03.868Z

Link: CVE-2026-84501

cve-icon Vulnrichment

Updated: 2026-09-16T10:12:02.894Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-16T10:16:53.557

Modified: 2026-09-16T20:17:34.620

Link: CVE-2026-84501

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T15:15:14Z

Weaknesses
  • CWE-117

    Improper Output Neutralization for Logs