Quick answers
- Is CVE-2026-84439 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84439 being exploited in the wild.
- How severe is CVE-2026-84439?
- Medium severity, with a CVSS score of 5.3, published 16 September 2026.
- Which products and versions are affected?
- Apache Zookeeper 3.8.0 through 3.8.6, 3.9.0 through 3.9.5.
- Is there a fix for CVE-2026-84439?
- A patch was published on 2026-09-16: Patch available in versions 3.8.7 and 3.9.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84439 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-84439?
- Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a log injection vulnerability in Apache ZooKeeper's audit logging mechanism (when zookeeper.audit.enable=true). The vulnerability exists because digest authentication usernames and ACL identifiers are serialized into the audit log without proper escaping of tab characters (\t). Since audit events use a tab-separated key=value format, an attacker can inject additional fields by embedding tabs in usernames or ACL ids, allowing them to spoof operation types (e.g., operation=delete), forge znode paths (e.g., znode=/forged), and inject fake results. The vulnerability affects versions 3.8.0–3.8.6 and 3.9.0–3.9.5; users should upgrade to 3.8.7 or 3.9.6. No public exploitation has been reported.
Affected products
- Apache ZooKeeper 3.8.0 through 3.8.6, 3.9.0 through 3.9.5
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patch available in versions 3.8.7 and 3.9.6