CVE-2026-84439 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache ZooKeeper deployments, particularly those with audit logging enabled, should assess their exposure and prioritize upgrading to a fixed version. Defenders should also review their audit logging configurations to ensure the integrity of their forensic evidence and monitor for suspicious activity.

Why it matters

The log injection vulnerability in Apache ZooKeeper's audit log allows an unauthenticated attacker to compromise the integrity of forensic evidence, making it essential for defenders to upgrade to a fixed version and review their audit logging configurations.

• Spoofing of audit results, allowing attackers to hide their activities
• Forging of operation types, making it difficult to determine the actual actions taken
• Corruption of forensic evidence, making it challenging to investigate incidents

Technical summary

The vulnerability allows an unauthenticated attacker to inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters embedded in the username, allowing them to spoof audit results, forge operation types, and corrupt forensic evidence. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue. The log injection vulnerability in Apache ZooKeeper's audit log allows a client that can call setACL to inject forged key-value fields into zookeeper_audit.log.

Defensive priority

Defenders should prioritize upgrading to version 3.9.6 or 3.8.7, which fixes the issue, and review their audit logging configurations to ensure the integrity of their forensic evidence.

Recommended defensive actions

• Upgrade to version 3.9.6 or 3.8.7
• Review audit logging configurations
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and recommended actions. Apache ZooKeeper's audit log is vulnerable to log injection attacks when audit logging is enabled. An unauthenticated attacker can inject arbitrary fields into the audit log by sending a digest authentication request with tab characters embedded in the username, allowing them to spoof audit results, forge operation types, and corrupt forensic evidence. The issue affects Apache ZooKeeper versions from 3.9.0 to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.