CVE-2026-100252 · Package
NO FIX YET · SEE WHAT TO DO
When SASL authentication is enabled on the ZooKeeper client port, the server accepts any identity a client requests instead of checking it against the authenticated principal. An authenticated client whose principal is not covered by auth_to_local rules can claim another SASL identity, including a configured superuser, and gain full access to the data tree.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Exposure requires SASL authentication enabled on the ZooKeeper client port and an authenticated client whose principal is not matched by any zookeeper.security.auth_to_local rule, such as a principal from a trusted cross-realm Kerberos realm. Deployments that use no SASL on the client port, or that restrict clients to principals covered by auth_to_local rules, are not described as affected.
Not affected if auth-required, default-config, no-sasl-client-port
Who cares hadoop, kafka, kerberos, sasl, zookeeper
zookeeper.superUser is set.zkServer.sh version and compare it to the fixed versions.zookeeper.security.auth_to_local rules and whether cross-realm Kerberos principals can connect.3.8.8 on the 3.8 line.3.9.7 on the 3.9 line.Improper Authorization vulnerability in Apache ZooKeeper.
When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.
An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.
Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-100252") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.