{
  "cveId": "CVE-2026-84439",
  "url": "https://patchblox.com/security/cve/CVE-2026-84439",
  "summary": "CVE-2026-84439 is fixed in zookeeper on 1 platform by DEBIAN-CVE-2026-84439 (version 3.9.6-1), released September 26, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "zookeeper: When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields...",
  "description": "When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper\u0027s audit log by sending a digest authentication request with tab characters (\\t) embedded in the username. Because the audit log uses tab-separated\u00A0key=value\u00A0format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting\u00A0result=success), forge operation types, and corrupt forensic evidence.  A log injection vulnerability in Apache ZooKeeper allows a client that can call\u00A0setACL\u00A0to inject forged key-value fields into\u00A0zookeeper_audit.log. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the\u00A0acl=\u00A0audit field without escaping tab characters. Because audit events are emitted as tab-separated\u00A0key=value\u00A0records, a crafted ACL id can make one successful\u00A0setAcl\u00A0event appear to contain forged fields such as\u00A0operation=delete\u00A0and\u00A0znode=/forged. This undermines the integrity of downstream audit parsing, alerting, and incident response.  This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.  Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.",
  "published": "2026-09-16T10:16:53Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss": 0.00742,
  "epssPercentile": 0.54961,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "zookeeper",
      "release": "Debian 14",
      "fixedVersion": "3.9.6-1",
      "fix": "DEBIAN-CVE-2026-84439",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-84439",
      "released": "2026-09-26T19:52:05Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}