CVE-2026-84501 Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

EUVD-2026-80334

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

CVE-2026-84501

Apache ZooKeeper versions 3.8.0–3.8.6 and 3.9.0–3.9.5 are affected by operational log forgery via newline injection in the EnsembleAuthenticationProvider . An unauthenticated attacker can send a crafted add_auth("ensemble", ...) request containing newline characters. When the ensemble name does n...