CVE-2026-84501

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

• CWE-117

• https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33yMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/09/15/7Mailing List

Published

Sep 16, 2026

Last Modified

Sep 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84489A buffer overflow was addressed with improved bounds checkin…5.5
• CVE-2026-8449Rejected reason: This CVE ID has been rejected or withdrawn.
• CVE-2026-84491A permissions issue was addressed with additional restrictio…5.5
• CVE-2026-84492A race condition was addressed with improved state handling.…4.7
• CVE-2026-84497A buffer overflow was addressed with improved size validatio…7.8
• CVE-2026-8450HTTP::Daemon versions before 6.17 for Perl allow OS command …9.1
• CVE-2026-84504fastify versions before 5.12.2 treat the object resolved by …8.1
• CVE-2026-84505An out-of-bounds write issue was addressed with improved bou…7.8
• CVE-2026-84506A use after free issue was addressed with improved memory ma…7.8
• CVE-2026-84507A race condition was addressed with improved state handling.…7.8
• CVE-2026-84509An out-of-bounds read was addressed with improved bounds che…6.5
• CVE-2026-8451Insufficient input validation in NetScaler ADC and NetScaler…7.5