CVE-2026-84501
published 2026-09-16CVE-2026-84501: An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request…
PriorityP335medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.74%
54.2th percentile
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zookeeper | — | — |
| apache | zookeeper | >= 3.8.0 < 3.8.7 | 3.8.7 |
| apache | zookeeper | >= 3.9.0 < 3.9.6 | 3.9.6 |
| apache_software_foundation | apache_zookeeper | 3.8.0 – 3.8.6 | — |
| apache_software_foundation | apache_zookeeper | 3.9.0 – 3.9.5 | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| rhoai | odh-modelmesh-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n).
ghsa_unreviewed·2026-09-16
CVE-2026-84501 [MEDIUM] CWE-117 An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n).
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
Red Hat
zookeeper: Apache ZooKeeper: Operational log forgery via newline injection
vendor_redhat·2026-09-16·CVSS 5.3
CVE-2026-84501 [MEDIUM] CWE-117 zookeeper: Apache ZooKeeper: Operational log forgery via newline injection
zookeeper: Apache ZooKeeper: Operational log forgery via newline injection
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.8.7 or 3.9.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84501 golang-github-samuel-zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [fedora-all]
bugzilla·2026-09-28·CVSS 5.3
CVE-2026-84501 [MEDIUM] CVE-2026-84501 golang-github-samuel-zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [fedora-all]
CVE-2026-84501 golang-github-samuel-zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbit
Bugzilla
CVE-2026-84501 golang-github-zookeeper-zk: Apache ZooKeeper: Operational log forgery via newline injection [epel-all]
bugzilla·2026-09-28·CVSS 5.3
CVE-2026-84501 [MEDIUM] CVE-2026-84501 golang-github-zookeeper-zk: Apache ZooKeeper: Operational log forgery via newline injection [epel-all]
CVE-2026-84501 golang-github-zookeeper-zk: Apache ZooKeeper: Operational log forgery via newline injection [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary t
Bugzilla
CVE-2026-84501 golang-github-zookeeper-zk: Apache ZooKeeper: Operational log forgery via newline injection [fedora-all]
bugzilla·2026-09-28·CVSS 5.3
CVE-2026-84501 [MEDIUM] CVE-2026-84501 golang-github-zookeeper-zk: Apache ZooKeeper: Operational log forgery via newline injection [fedora-all]
CVE-2026-84501 golang-github-zookeeper-zk: Apache ZooKeeper: Operational log forgery via newline injection [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary
Bugzilla
CVE-2026-84501 zookeeper: Apache ZooKeeper: Operational log forgery via newline injection
bugzilla·2026-09-16·CVSS 5.3
CVE-2026-84501 [MEDIUM] CVE-2026-84501 zookeeper: Apache ZooKeeper: Operational log forgery via newline injection
CVE-2026-84501 zookeeper: Apache ZooKeeper: Operational log forgery via newline injection
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to vers
2026-09-16
Published