[ CVE-2026-100252 · Published 4 Nov 2026 ]
Vulnerability in Apache Software Foundation Apache ZooKeeper
[ Description ]Official description
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks. An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
[ Fixes ]Fixes and patches
- Security bulletin: Apache Zookeeper securityVendor patch or bulletin · CERT-FR · zookeeper.apache.org/security.html, cited by CERT-FR CERTFR-2026-AVI-1448
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1448
Multiple vulnerabilities in Apache Zookeeper Translated from French
Multiple vulnerabilities have been discovered in Apache Zookeeper. They allow an attacker to cause remote denial of service and a security policy bypass.