Executive brief
Apache ZooKeeper is a distributed coordination service used by many enterprise systems to manage configuration and synchronization. An unauthenticated attacker can inject forged log entries that appear to be legitimate ZooKeeper operational logs, potentially misleading administrators and hindering incident investigation or compliance audits.
Technical details
The vulnerability is a log injection flaw in EnsembleAuthenticationProvider.handleAuthentication(). When an attacker sends a crafted add_auth("ensemble", ...) request with an ensemble name containing newline characters (\n), the unsanitized name is logged via LOG.warn() using SLF4J's {} placeholder. SLF4J does not escape embedded newlines, allowing attackers to forge complete log entries with arbitrary timestamps, log levels, class names, and messages. The attack requires no authentication and is network-reachable. Patches are available in versions 3.8.7 and 3.9.6.
Affected products
- Apache ZooKeeper 3.8.0 through 3.8.6, 3.9.0 through 3.9.5
Timeline
- 2026-09-16: disclosed
- 2026: patched: Fixed in versions 3.8.7 and 3.9.6