WaratekVRT Sign in

CVE-2026-84439 Apache zookeeper

Affected softwareApache zookeeper
Severity5.3 Medium CVSS 3.1
WeaknessCWE-117
Published16 Sep 2026
Updated18 Sep 2026

Published 59 days ago. NVD often adds the list of affected products days or weeks after a CVE is published, and the other sources we check lag too. The scope and status here may change.

Description

When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the audit log uses tab-separated key=value format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting result=success), forge operation types, and corrupt forensic evidence. A log injection vulnerability in Apache ZooKeeper allows a client that can call setACL to inject forged key-value fields into zookeeper_audit.log. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the acl= audit field without escaping tab characters. Because audit events are emitted as tab-separated key=value records, a crafted ACL id can make one successful setAcl event appear to contain forged fields such as operation=delete and znode=/forged. This undermines the integrity of downstream audit parsing, alerting, and incident response. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.

Exploitation status

No public exploit

No exploit has been reported in the sources we check.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.74% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review automated Upstream data
  • Record active
Decided by Nothing to build a rule from yet: no published exploit, no CISA record of exploitation and no source-level change to read
Finding This CVE affects a known product, but nothing published names a fix and nothing published shows an exploit. That is a statement about the evidence, not about the defect — it does not mean the vulnerability is unimportant or unreachable, only that neither of the two things VRT can act on exists.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2026 ↗ CPU 2026-Q4 Oracle Construction and Engineering / Platform (Apache ZooKeeper) (21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16, 25.12.0-25.12.9)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Construction and Engineering Platform (Apache ZooKeeper) 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16, 25.12.0-25.12.9

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd apache zookeeper generic ≥ 3.8.0 and ＜ 3.8.7 · ≥ 3.9.0 and ＜ 3.9.6

References

URLTags
https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6 Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/15/6 Mailing List, Vendor Advisory

Timeline
Published2026-09-16By the CVE Program.
NVD record modified2026-09-18NVD's own last-modified date for this record.