Log injection turns ZooKeeper audit records into attacker-controlled text

Two Apache ZooKeeper advisories from 16 September 2026 carry only a medium severity rating, and both attack the same asset: the integrity of the logs an investigator will read afterwards.

CVE-2026-84439 and CVE-2026-84501 are rated 5.3 with a CWE-117 classification in the NVD record. Their impact is not remote code execution or data theft. It is that a record of activity in a coordination service can be made to say something false, at a moment when the record is the only evidence available.

Audit log field injection

CVE-2026-84439 targets zookeeper_audit.log when audit logging is enabled through zookeeper.audit.enable=true . The audit writer emits tab-separated key=value records, and it writes attacker-controlled digest identifiers into the acl= field without escaping tab characters.

The advisory describes the outcome precisely.…