As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
CVE-2026-84501 affects Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5, allowing unauthenticated attackers to inject arbitrary fake log lines via newline characters in crafted add_auth requests to the EnsembleAuthenticationProvider. An attacker exploiting this vulnerability can forge operational logs, potentially masking malicious activity or creating false audit trails.
Why it matters: Organizations running vulnerable ZooKeeper versions in unauthenticated environments risk audit log tampering that could hide unauthorized access or changes; immediate patching or access controls are needed.
- Source published
- First seen by Cybersecurity Tracker