Improper Output Neutralization for Logs in Apache ZooKeeper - CVE-2026-84501
Published: September 16, 2026
Vulnerability identifier: #VU150212
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84501
CWE-ID: CWE-117
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge operational log entries.
The vulnerability exists due to improper output neutralization for logs in EnsembleAuthenticationProvider.handleAuthentication() when processing a crafted add_auth("ensemble", ...) request containing newline characters. A remote attacker can send a crafted authentication request to forge operational log entries.
Forged entries can include arbitrary timestamps, log levels, class names, and messages that appear visually indistinguishable from genuine ZooKeeper log output.
Affected software
Apache ZooKeeper
IBM SPSS Modeler
IBM Netezza Performance Server
Primavera Unifier
InfoSphere Data Replication
IBM SPSS Modeler
IBM Netezza Performance Server
Primavera Unifier
InfoSphere Data Replication
How to mitigate CVE-2026-84501
Install security update from vendor's website.
Apache ZooKeeper - addressed in versions 3.8.7, 3.9.6
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826
IBM SPSS Modeler - update to 19.0.0.0 IF034
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826