This vulnerability arises from improper output neutralization for logs (CWE-117) in Apache ZooKeeper's audit logging feature. Specifically, when audit logging is enabled (zookeeper.audit.enable=true), the server serializes digest ACL ids into the audit log without escaping tab characters. Because the audit log format uses tab-separated key=value pairs, injected tabs in the username or ACL id fields are interpreted as field separators, enabling an attacker to inject forged audit fields such as result=success or operation=delete. This can mislead forensic analysis and incident response by corrupting audit trail integrity. The vulnerability affects Apache ZooKeeper versions from 3.8.0 to 3.8.6 and 3.9.0 to 3.9.5. The vendor recommends upgrading to 3.8.7 or 3.9.6 to remediate the issue.

An unauthenticated attacker can manipulate audit logs by injecting arbitrary fields, potentially forging audit results and operation types. This compromises the reliability and integrity of audit logs, which are critical for forensic investigations, alerting, and incident response. Although the vulnerability does not directly allow code execution or data breach, it undermines trust in audit records and could hinder detection of malicious activity.

A fix is available. Users should upgrade Apache ZooKeeper to version 3.8.7 or 3.9.6, where this log injection vulnerability has been addressed by properly escaping tab characters in audit logs. No other mitigation is specified or required once the upgrade is applied.