---
id: "CVE-2026-100252"
kind: "vulnerability"
aliases: ["CVE-2026-100252"]
title: "Apache ZooKeeper: SASL identity check lets authenticated clients claim any identity"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hadoop", "kafka", "kerberos", "package", "sasl", "zookeeper"]
not_affected_if: ["auth-required", "default-config", "no-sasl-client-port"]
published_at: "2026-11-04T11:17:06+00:00"
first_seen_at: "2026-11-04T11:26:45+00:00"
updated_at: "2026-11-04T11:27:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100252", "first_seen_at": "2026-11-04T11:26:45+00:00"}]
---

# Apache ZooKeeper: SASL identity check lets authenticated clients claim any identity

When SASL authentication is enabled on the ZooKeeper client port, the server accepts any identity a client requests instead of checking it against the authenticated principal. An authenticated client whose principal is not covered by auth_to_local rules can claim another SASL identity, including a configured superuser, and gain full access to the data tree.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether SASL authentication is enabled on the client port and whether `zookeeper.superUser` is set.
- Check the installed ZooKeeper version with `zkServer.sh version` and compare it to the fixed versions.
- Review `zookeeper.security.auth_to_local` rules and whether cross-realm Kerberos principals can connect.

## Fix

- Upgrade Apache ZooKeeper to `3.8.8` on the 3.8 line.
- Upgrade Apache ZooKeeper to `3.9.7` on the 3.9 line.

## Timeline

- 2026-11-04T11:26:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100252

## From the sources

Improper Authorization vulnerability in Apache ZooKeeper.

When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.

An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.

Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_