SB2026091652 - Multiple vulnerabilities in Apache ZooKeeper

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091652

SB2026091652 - Multiple vulnerabilities in Apache ZooKeeper

Published: September 16, 2026

Security Bulletin ID SB2026091652
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 20% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-84501)

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge operational log entries.

The vulnerability exists due to improper output neutralization for logs in EnsembleAuthenticationProvider.handleAuthentication() when processing a crafted add_auth("ensemble", ...) request containing newline characters. A remote attacker can send a crafted authentication request to forge operational log entries.

Forged entries can include arbitrary timestamps, log levels, class names, and messages that appear visually indistinguishable from genuine ZooKeeper log output.


2) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-84439)

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to tamper with audit log records.

The vulnerability exists due to improper output neutralization in audit log serialization when processing digest authentication requests or setACL operations containing tab characters. A remote user can submit a crafted digest username or ACL identifier to inject forged key-value fields into the audit log.

The issue is exploitable only when audit logging is enabled.


3) Missing Authorization (CVE-ID: CVE-2026-79993)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to delete empty persistent, container, and TTL znodes regardless of ACL restrictions.

The vulnerability exists due to missing authorization in the deleteContainer opcode when processing a raw deleteContainer protocol request. A remote attacker can open a plain TCP session to the ZooKeeper client port and issue the raw protocol opcode to delete an empty znode.

The deleteContainer request path skips both the session check and the DELETE ACL check.


4) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-59969)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to join quorum traffic and participate in leader election and replication flows.

The vulnerability exists due to improper validation of certificate hostnames in the Java SSLSocket quorum path when processing a CA-trusted peer certificate whose SAN does not match the connected host in a FIPS-mode deployment. A remote user can present such a peer certificate to join quorum traffic and participate in leader election and replication flows.


5) Missing Authorization (CVE-ID: CVE-2026-59739)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose ACL-restricted znode paths.

The vulnerability exists due to a missing authorization check in the DataTree.setWatches() SetWatches/SetWatches2 reconnect replay handler when replaying registered exists-watches after a client reconnects. A remote attacker can register exists-watches on non-existent paths and reconnect after the paths are created with restricted ACLs to disclose ACL-restricted znode paths.

Only znode paths are exposed; znode data is not exposed.


Remediation

Install update from vendor's website.

References