{"id":"CVE-2026-100252","kind":"vulnerability","aliases":["CVE-2026-100252"],"related":[],"title":"Apache ZooKeeper: SASL identity check lets authenticated clients claim any identity","description":"Improper Authorization vulnerability in Apache ZooKeeper.\n\nWhen SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.\n\nAn authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.\n\nUsers are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.","summary":"When SASL authentication is enabled on the ZooKeeper client port, the server accepts any identity a client requests instead of checking it against the authenticated principal. An authenticated client whose principal is not covered by auth_to_local rules can claim another SASL identity, including a configured superuser, and gain full access to the data tree.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hadoop","kafka","kerberos","package","sasl","zookeeper"],"not_affected_if":["auth-required","default-config","no-sasl-client-port"],"how_to_check":"- Check whether SASL authentication is enabled on the client port and whether `zookeeper.superUser` is set.\n- Check the installed ZooKeeper version with `zkServer.sh version` and compare it to the fixed versions.\n- Review `zookeeper.security.auth_to_local` rules and whether cross-realm Kerberos principals can connect.","fix":"- Upgrade Apache ZooKeeper to `3.8.8` on the 3.8 line.\n- Upgrade Apache ZooKeeper to `3.9.7` on the 3.9 line.","status":"open","published_at":"2026-11-04T11:17:06+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","triaged_at":"2026-11-04T11:27:32+00:00","updated_at":"2026-11-04T11:27:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T11:27:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache ZooKeeper to `3.8.8` on the 3.8 line.\n- Upgrade Apache ZooKeeper to `3.9.7` on the 3.9 line.","reach":"network","title":"Apache ZooKeeper: SASL identity check lets authenticated clients claim any identity","impact":"high","summary":"When SASL authentication is enabled on the ZooKeeper client port, the server accepts any identity a client requests instead of checking it against the authenticated principal. An authenticated client whose principal is not covered by auth_to_local rules can claim another SASL identity, including a configured superuser, and gain full access to the data tree.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zookeeper","kerberos","sasl","kafka","hadoop"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated client becomes superuser and reads or changes the whole data tree","analyst_note":"","how_to_check":"- Check whether SASL authentication is enabled on the client port and whether `zookeeper.superUser` is set.\n- Check the installed ZooKeeper version with `zkServer.sh version` and compare it to the fixed versions.\n- Review `zookeeper.security.auth_to_local` rules and whether cross-realm Kerberos principals can connect.","plain_action":"","needs_analyst":false,"not_affected_if":["no-sasl-client-port","auth-required","default-config"],"who_is_affected":"Exposure requires SASL authentication enabled on the ZooKeeper client port and an authenticated client whose principal is not matched by any zookeeper.security.auth_to_local rule, such as a principal from a trusted cross-realm Kerberos realm. Deployments that use no SASL on the client port, or that restrict clients to principals covered by auth_to_local rules, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4382,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100252':14A,17A '-2026':13A,16A '3.8.8':262C '3.9.7':264C 'accept':36B 'access':75B,249C 'acl':173C,237C 'anoth':65B 'apach':1A,84C 'appli':147C 'auth':59B,185C 'authent':7A,26B,48B,51B,88C,118C,135C,176C 'author':81C,103C 'authzid':105C,163C 'becom':165C 'callback':99C 'canon':131C 'canonic':151C 'check':5A,44B,111C,174C 'claim':9A,64B,191C 'client':8A,32B,40B,52B,93C,108C,117C,161C,177C,226C 'client-request':160C 'configur':70B,244C 'cover':57B,182C 'cross':221C 'cross-realm':220C 'cve':12A,15A 'data':78B,253C 'default':197C,212C 'deriv':137C 'enabl':28B,90C 'error':155C 'everi':102C 'fail':152C 'fix':266C 'form':132C 'full':74B 'gain':73B 'get':228C,247C 'grant':101C,231C 'hadoop':18B 'handler':100C 'ident':4A,11A,38B,67B,104C,128C,170C,194C,234C,241C 'improp':80C 'includ':68B,200C 'instead':42B 'issu':268C 'kafka':19B 'kerbero':20B,202C 'let':6A 'local':61B,142C,187C 'log':158C 'match':242C 'packag':21B 'permiss':230C 'port':33B,94C 'princip':49B,54B,115C,136C,150C,179C,203C,217C 'realm':206C,213C,222C,224C 'recommend':257C 'replac':125C 'request':41B,109C,127C,162C,240C 'rule':62B,143C,146C,188C,198C 'sasl':3A,22B,25B,66B,87C,98C,169C,193C,236C 'server':35B,96C,121C,210C 'session':167C 'superus':71B,248C 'therefor':190C 'tree':79B,254C 'tri':123C 'trust':223C 'upgrad':259C 'user':255C 'version':261C 'vulner':82C 'whole':252C 'whose':53B,178C 'without':110C 'zookeep':2A,23B,31B,85C 'zookeeper.security.auth':140C 'zookeeper.superuser':245C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires SASL authentication enabled on the ZooKeeper client port and an authenticated client whose principal is not matched by any zookeeper.security.auth_to_local rule, such as a principal from a trusted cross-realm Kerberos realm. Deployments that use no SASL on the client port, or that restrict clients to principals covered by auth_to_local rules, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hadoop","high","kafka","kerberos","package","sasl","zookeeper"],"campaign_type":null,"first_public_at":"2026-11-04T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100252","severity":null,"published_at":"2026-11-04T11:17:06+00:00","modified_at":"2026-11-04T11:17:06+00:00","first_seen_at":"2026-11-04T11:26:45+00:00","fetched_at":"2026-11-04T11:26:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}