Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1177
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Apache Zookeeper. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Zookeeper versions 3.9.x ant\u00e9rieures \u00e0 3.9.6",
"product": {
"name": "Zookeeper",
"vendor": {
"name": "Apache",
"scada": false
}
}
},
{
"description": "Zookeeper versions 3.8.x ant\u00e9rieures \u00e0 3.8.7",
"product": {
"name": "Zookeeper",
"vendor": {
"name": "Apache",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-84439",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84439"
},
{
"name": "CVE-2026-84501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84501"
},
{
"name": "CVE-2026-59739",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59739"
},
{
"name": "CVE-2026-59969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59969"
},
{
"name": "CVE-2026-79993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79993"
}
],
"initial_release_date": "2026-09-16T00:00:00",
"last_revision_date": "2026-09-16T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1177",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-16T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Zookeeper. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Zookeeper",
"vendor_advisories": [
{
"published_at": "2026-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 Apache Zookeeper security",
"url": "https://zookeeper.apache.org/security.html"
}
]
}
CVE-2026-59969 (GCVE-0-2026-59969)
Vulnerability from cvelistv5
Published
2026-09-16 09:27
Modified
2026-09-16 10:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-297 - Improper Validation of Certificate with Host Mismatch
Summary
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper |
Version: 3.9.0 Version: 3.8.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-16T10:11:44.041Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/15/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.zookeeper:zookeeper",
"packageURL": "pkg:maven/org.apache.zookeeper/zookeeper",
"product": "Apache ZooKeeper",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "3.9.5",
"status": "affected",
"version": "3.9.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erichen \u003cchenyoulong20g@ict.ac.cn\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When \u003ccode\u003esslQuorum=true\u003c/code\u003e, \u003ccode\u003ezookeeper.fips-mode=true\u003c/code\u003e, \u003ccode\u003essl.quorum.hostnameVerification=true\u003c/code\u003e, and \u003ccode\u003essl.quorum.clientHostnameVerification=true\u003c/code\u003e\u0026nbsp;are enabled, the Java \u003ccode\u003eSSLSocket\u003c/code\u003e\u0026nbsp;quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true\u00a0are enabled, the Java SSLSocket\u00a0quorum path accepts a CA-trusted peer certificate whose SAN does not match the connected host. A malicious or misissued peer certificate can therefore join quorum traffic, participate in leader election, and enter replication flows.\n\n\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T09:27:00.726Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/qf9kwsgtgbgtvwls6f41281846xg0rss"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-59969",
"datePublished": "2026-09-16T09:27:00.726Z",
"dateReserved": "2026-07-07T18:50:40.959Z",
"dateUpdated": "2026-09-16T10:11:44.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59739 (GCVE-0-2026-59739)
Vulnerability from cvelistv5
Published
2026-09-16 09:26
Modified
2026-09-16 09:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799). The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() — the SetWatches/SetWatches2 reconnect replay handler — still calls watcher.process(event) with null ACL, bypassing the check entirely. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.
Users are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper |
Version: 3.9.0 Version: 3.8.0 ≤ 3.8.6 |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.zookeeper:zookeeper",
"packageURL": "pkg:maven/org.apache.zookeeper/zookeeper",
"product": "Apache ZooKeeper",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "3.9.5",
"status": "affected",
"version": "3.9.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "NGUYEN HONG QUAN \u003chongquanvp11@gmail.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "n0mi1k \u003cnomilksec@gmail.com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check.\u0026nbsp;An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for\u0026nbsp;CVE-2024-23944 (ZOOKEEPER-4799).\u0026nbsp;The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() \u2014 the SetWatches/SetWatches2 reconnect replay handler \u2014 still calls watcher.process(event) with null ACL, bypassing the check entirely. It\u0027s important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue."
}
],
"value": "Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check.\u00a0An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete fix for\u00a0CVE-2024-23944 (ZOOKEEPER-4799).\u00a0The fix added ACL checking to WatchManager.triggerWatch(). However, DataTree.setWatches() \u2014 the SetWatches/SetWatches2 reconnect replay handler \u2014 still calls watcher.process(event) with null ACL, bypassing the check entirely. It\u0027s important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.\n\nUsers are recommended to upgrade to version 3.9.6, 3.8.7 which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "critical"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T09:26:37.690Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/v0lrwsbdxvx6w67p3z7fxf3hzyncq55l"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache ZooKeeper: Information disclosure via SetWatches reconnect replay",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-59739",
"datePublished": "2026-09-16T09:26:37.690Z",
"dateReserved": "2026-07-06T20:46:19.936Z",
"dateUpdated": "2026-09-16T09:26:37.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84501 (GCVE-0-2026-84501)
Vulnerability from cvelistv5
Published
2026-09-16 09:28
Modified
2026-09-16 19:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-117 - Improper output neutralization for logs
Summary
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper |
Version: 3.9.0 Version: 3.8.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-16T10:12:02.894Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/15/7"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-84501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:42:27.138755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:43:09.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.zookeeper:zookeeper",
"packageURL": "pkg:maven/org.apache.zookeeper/zookeeper",
"product": "Apache ZooKeeper",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "3.9.5",
"status": "affected",
"version": "3.9.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Youlong Chen Institute of Computing Technology \u003cchenyoulong20g@ict.ac.cn\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper\u0027s operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn\u0027t match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J\u0027s {} placeholder preserves embedded newlines, the attacker can forge complete log entries \u2014 with arbitrary timestamps, log levels, class names, and messages \u2014 that are visually indistinguishable from genuine ZooKeeper log output.\u003cbr\u003e\u003cspan\u003e\u003cbr\u003eThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper\u0027s operational log by sending a crafted add_auth(\"ensemble\", ...) request containing newline characters (\\n). When the ensemble name doesn\u0027t match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J\u0027s {} placeholder preserves embedded newlines, the attacker can forge complete log entries \u2014 with arbitrary timestamps, log levels, class names, and messages \u2014 that are visually indistinguishable from genuine ZooKeeper log output.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117 Improper output neutralization for logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T09:28:10.294Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-84501",
"datePublished": "2026-09-16T09:28:10.294Z",
"dateReserved": "2026-09-01T20:56:03.868Z",
"dateUpdated": "2026-09-16T19:43:09.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79993 (GCVE-0-2026-79993)
Vulnerability from cvelistv5
Published
2026-09-16 09:27
Modified
2026-09-16 10:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn't have API for it, but a client that can open a plain TCP session on the ZooKeeper client port (2181 by default) - with NO authentication and NO ACL permissions - can delete any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20). The deleteContainer request path completely skips both the session check and the DELETE ACL check that are enforced by the regular delete (OpCode 2) path. This is an authorization bypass / ACL enforcement bug.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper |
Version: 3.9.0 Version: 3.8.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-16T10:11:55.778Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/15/5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.zookeeper:zookeeper",
"packageURL": "pkg:maven/org.apache.zookeeper/zookeeper",
"product": "Apache ZooKeeper",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "3.9.5",
"status": "affected",
"version": "3.9.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "K \u003csec-reports@outlook.com\u003e"
},
{
"lang": "en",
"type": "reporter",
"value": "z f \u003ctinkerzf@gmail.com\u003e"
},
{
"lang": "en",
"type": "finder",
"value": "\u5e03\u8c6a \u003c1958304602@qq.com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThe `deleteContainer` opcode (0x14/20) is processed without verifying the caller\u0027s ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn\u0027t have API for it, but a\u0026nbsp;\u003c/span\u003e\u003cspan\u003eclient that can open a plain TCP session on the ZooKeeper client port (2181 by default)\u0026nbsp;\u003c/span\u003e\u003cspan\u003e- with NO authentication and NO ACL permissions - can delete any\u003c/span\u003e\u003cspan\u003e\u0026nbsp;empty persistent znode (including regular persistent nodes, container\u0026nbsp;\u003c/span\u003e\u003cspan\u003enodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20).\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThe deleteContainer request path completely skips both the session check and\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe DELETE ACL check that are enforced by the regular delete (OpCode 2) path.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThis is an authorization bypass / ACL enforcement bug.\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003eThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The `deleteContainer` opcode (0x14/20) is processed without verifying the caller\u0027s ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official client doesn\u0027t have API for it, but a\u00a0client that can open a plain TCP session on the ZooKeeper client port (2181 by default)\u00a0- with NO authentication and NO ACL permissions - can delete any\u00a0empty persistent znode (including regular persistent nodes, container\u00a0nodes, and TTL nodes) by issuing the raw protocol OpCode deleteContainer (20).\u00a0The deleteContainer request path completely skips both the session check and\u00a0the DELETE ACL check that are enforced by the regular delete (OpCode 2) path.\u00a0This is an authorization bypass / ACL enforcement bug.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "critical"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T09:27:22.516Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-79993",
"datePublished": "2026-09-16T09:27:22.516Z",
"dateReserved": "2026-08-25T16:40:35.796Z",
"dateUpdated": "2026-09-16T10:11:55.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84439 (GCVE-0-2026-84439)
Vulnerability from cvelistv5
Published
2026-09-16 09:27
Modified
2026-09-16 10:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-117 - Improper output neutralization for logs
Summary
When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters (\t) embedded in the username. Because the audit log uses tab-separated key=value format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting result=success), forge operation types, and corrupt forensic evidence.
A log injection vulnerability in Apache ZooKeeper allows a client that can call setACL to inject forged key-value fields into zookeeper_audit.log. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the acl= audit field without escaping tab characters. Because audit events are emitted as tab-separated key=value records, a crafted ACL id can make one successful setAcl event appear to contain forged fields such as operation=delete and znode=/forged. This undermines the integrity of downstream audit parsing, alerting, and incident response.
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.
Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper |
Version: 3.9.0 Version: 3.8.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-16T10:12:00.087Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/15/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.zookeeper:zookeeper",
"packageURL": "pkg:maven/org.apache.zookeeper/zookeeper",
"product": "Apache ZooKeeper",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "3.9.5",
"status": "affected",
"version": "3.9.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Youlong Chen Institute of Computing Technology \u003cchenyoulong20g@ict.ac.cn\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen audit logging is enabled (\u003ccode\u003ezookeeper.audit.enable=true\u003c/code\u003e), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper\u0027s audit log by sending a digest authentication request with tab characters (\u003ccode\u003e\\t\u003c/code\u003e) embedded in the username. Because the audit log uses tab-separated\u0026nbsp;\u003ccode\u003ekey=value\u003c/code\u003e\u0026nbsp;format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting\u0026nbsp;\u003ccode\u003eresult=success\u003c/code\u003e), forge operation types, and corrupt forensic evidence.\u003cbr\u003e\u003cspan\u003e\u003cbr\u003eA log injection vulnerability in Apache ZooKeeper allows a client that can call\u0026nbsp;\u003c/span\u003e\u003ccode\u003esetACL\u003c/code\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto inject forged key-value fields into\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003ccode\u003ezookeeper_audit.log\u003c/code\u003e\u003cspan\u003e. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003ccode\u003eacl=\u003c/code\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaudit field without escaping tab characters. Because audit events are emitted as tab-separated\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003ccode\u003ekey=value\u003c/code\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003erecords, a crafted ACL id can make one successful\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003ccode\u003esetAcl\u003c/code\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eevent appear to contain forged fields such as\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003ccode\u003eoperation=delete\u003c/code\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eand\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003ccode\u003eznode=/forged\u003c/code\u003e\u003cspan\u003e. This undermines the integrity of downstream audit parsing, alerting, and incident response.\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003eThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper\u0027s audit log by sending a digest authentication request with tab characters (\\t) embedded in the username. Because the audit log uses tab-separated\u00a0key=value\u00a0format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting\u00a0result=success), forge operation types, and corrupt forensic evidence.\n\nA log injection vulnerability in Apache ZooKeeper allows a client that can call\u00a0setACL\u00a0to inject forged key-value fields into\u00a0zookeeper_audit.log. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the\u00a0acl=\u00a0audit field without escaping tab characters. Because audit events are emitted as tab-separated\u00a0key=value\u00a0records, a crafted ACL id can make one successful\u00a0setAcl\u00a0event appear to contain forged fields such as\u00a0operation=delete\u00a0and\u00a0znode=/forged. This undermines the integrity of downstream audit parsing, alerting, and incident response.\n\nThis issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.\n\nUsers are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117 Improper output neutralization for logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T09:27:46.439Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-84439",
"datePublished": "2026-09-16T09:27:46.439Z",
"dateReserved": "2026-09-01T19:22:00.838Z",
"dateUpdated": "2026-09-16T10:12:00.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…