Arbitrary Log Injection in Apache ZooKeeper Operational Log

CVE-2026-84501

What is CVE-2026-84501?

An unauthenticated attacker can exploit a flaw in Apache ZooKeeper to inject arbitrary log entries into its operational log. This is executed by sending a specially crafted request to the add_auth function, which allows newline characters. When the ensemble name does not match, the vulnerable method logs this unsanitized name, enabling an attacker to fabricate log entries. These forged entries can include arbitrary timestamps, log levels, class names, and messages, making them indistinguishable from legitimate ZooKeeper log output. To mitigate this vulnerability, users should upgrade to Apache ZooKeeper version 3.8.7 or later for version 3.8.x and to version 3.9.6 or later for version 3.9.x.

References