PT-2026-95847

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add auth"ensemble", ... request containing newline characters . When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

PT-2026-93418

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.8.0 through 3.8.6 Apache ZooKeeper versions 3.9.0 through 3.9.5 Description An unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add auth"ensemble", ... reque...

CVE-2026-84501: Improper Output Neutralization for Logs

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...