Apache ZooKeeper suffers from an improper output neutralization vulnerability (CWE-117) in its logging mechanism. An unauthenticated attacker can send a crafted add_auth("ensemble", ...) request with newline characters in the ensemble name. When the ensemble name does not match, the EnsembleAuthenticationProvider.handleAuthentication() method logs the raw, unsanitized name using LOG.warn(). Because SLF4J's placeholder preserves embedded newlines, this allows the attacker to inject fake log lines with arbitrary timestamps, log levels, class names, and messages that are visually indistinguishable from legitimate log entries. This affects Apache ZooKeeper versions from 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. The issue is resolved in versions 3.8.7 and 3.9.6.

The vulnerability allows unauthenticated attackers to forge log entries in Apache ZooKeeper's operational logs. This can mislead administrators or automated systems that rely on logs for monitoring and incident response by injecting misleading or fake log data. There is no indication of direct code execution or data compromise from this vulnerability alone.

Users should upgrade Apache ZooKeeper to version 3.8.7 or 3.9.6, where this issue has been fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory recommending these fixed versions.