Executive brief
Apache ZooKeeper is a distributed coordination service used by many enterprise applications to manage configuration and distributed system state. When audit logging is enabled, an attacker can inject forged fields into the audit log by exploiting improper escaping of tab characters in authentication and ACL data, allowing them to forge audit records and cover their tracks during incident investigations.
Technical details
This is a log injection vulnerability in Apache ZooKeeper's audit logging mechanism (when zookeeper.audit.enable=true). The vulnerability exists because digest authentication usernames and ACL identifiers are serialized into the audit log without proper escaping of tab characters (\t). Since audit events use a tab-separated key=value format, an attacker can inject additional fields by embedding tabs in usernames or ACL ids, allowing them to spoof operation types (e.g., operation=delete), forge znode paths (e.g., znode=/forged), and inject fake results. The vulnerability affects versions 3.8.0–3.8.6 and 3.9.0–3.9.5; users should upgrade to 3.8.7 or 3.9.6. No public exploitation has been reported.
Affected products
- Apache ZooKeeper 3.8.0 through 3.8.6, 3.9.0 through 3.9.5
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patch available in versions 3.8.7 and 3.9.6