CVE-2026-84501 Overview
CVE-2026-84501 is a log injection vulnerability [CWE-117] in Apache ZooKeeper. An unauthenticated attacker can inject arbitrary log entries into the operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. When the supplied ensemble name does not match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized value through LOG.warn(). Because the SLF4J {} placeholder preserves embedded newlines, an attacker can forge complete log entries with arbitrary timestamps, log levels, class names, and messages that are visually indistinguishable from genuine ZooKeeper output. The flaw affects Apache ZooKeeper 3.9.0 through 3.9.5 and 3.8.0 through 3.8.6.
Critical Impact
Unauthenticated remote attackers can forge ZooKeeper log entries to mislead investigators, hide malicious activity, or frame legitimate operations.
Affected Products
- Apache ZooKeeper 3.9.0 through 3.9.5
- Apache ZooKeeper 3.8.0 through 3.8.6
- Deployments exposing the ZooKeeper client port to untrusted networks
Discovery Timeline
- 2026-09-16 - CVE-2026-84501 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-84501
Vulnerability Analysis
Apache ZooKeeper supports an ensemble authentication scheme where clients present an ensemble name through the add_auth client protocol operation. The server validates the submitted name against its configured ensemble identifier. On mismatch, EnsembleAuthenticationProvider.handleAuthentication() records a warning that includes the attacker-supplied string. The logging call passes the string through SLF4J parameterized formatting without stripping control characters.
Because SLF4J's {} placeholder does not sanitize newline (\n) or carriage return (\r) characters, an attacker can embed a full log record inside the ensemble field. The injected content renders on subsequent lines with attacker-chosen timestamps, severity levels, thread names, and logger identifiers. Downstream log parsers, security information and event management systems, and human analysts cannot reliably distinguish forged entries from authentic ZooKeeper output.
Root Cause
The root cause is missing output neutralization for log files [CWE-117]. The handleAuthentication() method treats untrusted network input as safe log content and relies on a formatter that preserves line terminators. No allowlist, escape routine, or replacement of control characters is applied before the value reaches the log appender.
Attack Vector
Exploitation requires only network reachability to the ZooKeeper client port. No authentication or user interaction is needed. An attacker opens a client session and issues an add_auth request with scheme ensemble and a payload containing \n sequences followed by a synthesized log line. Each failed attempt produces one attacker-controlled warning plus any injected lines, allowing bulk generation of forged events. The confidentiality and availability of the service are not directly affected, but integrity of the audit trail is compromised.
See the Apache Mailing List Discussion and the OpenWall OSS-Security Update for the upstream advisory.
Detection Methods for CVE-2026-84501
Indicators of Compromise
- Warning entries originating from EnsembleAuthenticationProvider that contain unexpected embedded newlines or control characters.
- Multiple consecutive log records with identical timestamps but inconsistent thread identifiers or logger names.
- Bursts of failed ensemble authentication events from a single source address preceding suspicious log entries.
- Log lines whose formatting differs subtly from the ZooKeeper log pattern, such as misaligned fields or duplicated level tokens.
Detection Strategies
- Parse ZooKeeper logs with a strict grammar and flag records where the message field contains raw \n, \r, or ANSI escape sequences.
- Correlate add_auth failures on the ZooKeeper client port with subsequent anomalous log entries within the same second.
- Baseline the frequency of EnsembleAuthenticationProvider warnings and alert on sudden spikes.
Monitoring Recommendations
- Forward ZooKeeper logs to a centralized platform that preserves raw bytes so injected control characters remain visible for review.
- Monitor network access to ZooKeeper client ports (default 2181) from outside the trusted management segment.
- Enable audit logging on any downstream SIEM parsing pipeline to identify records that fail schema validation.
How to Mitigate CVE-2026-84501
Immediate Actions Required
- Upgrade Apache ZooKeeper to version 3.8.7 or 3.9.6, which remove control characters before logging the ensemble name.
- Restrict network access to the ZooKeeper client port so only trusted application servers can reach it.
- Review historical ZooKeeper logs for injected entries before relying on them for incident investigations.
Patch Information
The Apache ZooKeeper project has released fixed versions 3.8.7 and 3.9.6. Both releases sanitize the ensemble name in EnsembleAuthenticationProvider.handleAuthentication() before it is passed to the logger. Operators running any 3.8.x or 3.9.x release in the affected range should plan an upgrade. Refer to the Apache Mailing List Discussion for release notes.
Workarounds
- Place ZooKeeper behind a network access control list that blocks untrusted clients from reaching the client port.
- Require mutual TLS on the ZooKeeper client port to prevent unauthenticated add_auth requests from external sources.
- Configure log ingestion tools to strip or escape newline and carriage return characters within message fields prior to indexing.
# Example iptables rule limiting ZooKeeper client port access
iptables -A INPUT -p tcp --dport 2181 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2181 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
