CVE-2026-84439 Overview
CVE-2026-84439 is a log injection vulnerability [CWE-117] in Apache ZooKeeper's audit logging subsystem. When audit logging is enabled with zookeeper.audit.enable=true, the server serializes attacker-controlled digest ACL identifiers into the acl= audit field without escaping tab characters. Because audit events use tab-separated key=value records, a crafted ACL identifier can forge fields such as operation=delete and znode=/forged inside a single legitimate setAcl event. A related path allows an unauthenticated attacker to inject arbitrary fields by sending a digest authentication request containing embedded tab characters in the username. The flaw undermines the integrity of downstream audit parsing, alerting, and incident response workflows.
Critical Impact
Attackers can forge audit records to spoof result=success outcomes, mask malicious operations, and corrupt forensic evidence used during incident response.
Affected Products
- Apache ZooKeeper 3.9.0 through 3.9.5
- Apache ZooKeeper 3.8.0 through 3.8.6
- Deployments with zookeeper.audit.enable=true configured
Discovery Timeline
- 2026-09-16 - CVE CVE-2026-84439 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-84439
Vulnerability Analysis
Apache ZooKeeper emits audit events as tab-separated key=value records written to zookeeper_audit.log. The audit writer does not sanitize or escape tab (\t) characters present in user-controlled fields before serialization. Two input paths trigger the flaw. First, the digest authentication handler accepts usernames that may contain raw tab bytes, and those bytes are written directly into the audit line. Second, the setAcl code path serializes digest ACL identifiers into the acl= field with the same lack of escaping.
An attacker who can supply either input can extend a single audit record with forged fields. Log analyzers, SIEM parsers, and human reviewers then treat the injected fields as authentic. This breaks the reliability guarantees of the audit log as a forensic artifact.
Root Cause
The root cause is missing output neutralization for tab characters in the audit log serializer. The format assumes that field values never contain the delimiter, but no validation enforces that assumption on attacker-controlled fields such as digest usernames and ACL identifiers.
Attack Vector
Exploitation requires the ability to reach the ZooKeeper client port. For the digest authentication path, no prior authentication is required. For the setAcl path, the attacker must hold the ACL permissions needed to call setAcl on any znode. In both cases, the attacker crafts a value containing tab characters followed by forged key=value pairs. When the server writes the audit event, the injected pairs appear as legitimate fields such as operation=delete, znode=/forged, or result=success.
No verified public exploit code is available. See the Apache Mailing List Thread and OpenWall OSS Security Update for technical details.
Detection Methods for CVE-2026-84439
Indicators of Compromise
- Audit log lines containing multiple operation= or result= keys within a single event record.
- Digest authentication events where the username field contains non-printable characters or unexpected key=value fragments.
- setAcl audit entries where the acl= field expands into additional fields such as znode= or session=.
- Discrepancies between ZooKeeper server logs and corresponding entries in zookeeper_audit.log.
Detection Strategies
- Parse zookeeper_audit.log with a strict tokenizer that flags any record containing duplicate field keys.
- Correlate audit events against zookeeper.out server logs to detect mismatched operation types or results.
- Alert on any digest authentication attempt whose username contains bytes outside the expected character class.
Monitoring Recommendations
- Forward ZooKeeper audit logs to a central platform and normalize field extraction for tamper detection.
- Baseline the set of principals that call setAcl and alert on new callers issuing ACL identifiers with unusual length or content.
- Monitor for unauthenticated digest authentication requests originating from unexpected client IP ranges.
How to Mitigate CVE-2026-84439
Immediate Actions Required
- Upgrade Apache ZooKeeper to version 3.9.6 or 3.8.7, which contain the fix.
- If patching is not immediately possible, restrict network access to the ZooKeeper client port to trusted hosts only.
- Review recent zookeeper_audit.log content for signs of forged fields and preserve copies for forensic analysis.
Patch Information
The Apache ZooKeeper project fixed the issue in versions 3.9.6 and 3.8.7. The patched releases escape tab characters in audit field values so that attacker-controlled input can no longer break the tab-separated record structure. Refer to the Apache Mailing List Thread for release details.
Workarounds
- Disable audit logging by setting zookeeper.audit.enable=false if audit records are not required, accepting the loss of visibility.
- Enforce authentication and authorization so that only trusted principals can call setAcl.
- Front ZooKeeper with a network policy that blocks untrusted clients from reaching the client port.
- Add a downstream log-parsing rule that rejects or quarantines audit records containing more than one occurrence of any reserved key.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.