High [CVE-2026-100252] Improper Authorization vulnerability in Apache ZooKeeper
This high-severity Apache Software Foundation advisory covers CVE-2026-100252 affecting Apache ZooKeeper.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino) publishes the next one.
See Apache Software Foundation Data & Analytics (Spark/Hadoop/Gravitino)'s last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Improper Authorization vulnerability in Apache ZooKeeper.
When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as.
The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged.
The client-requested authzid then becomes the session's SASL identity for all ACL checks.
An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm.
The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.
Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
- Apache ZooKeeper 3.9.0 through 3.9.6
- Apache ZooKeeper 3.8.0 through 3.8.7
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
- 3.8.8
- 3.9.7
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
Mitigation checklist
- The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules.
- Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Official advisory · high-confidence parse· fetched 14 hours ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-100302Nov 4, 2026Apache ZooKeeper denial of service
- CVE-2026-115448Nov 4, 2026Uncontrolled recursion in Apache ZooKeeper
- CVE-2026-100300Nov 4, 2026Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper
- CVE-2026-100235Nov 4, 2026Apache ZooKeeper improper access control
- CVE-2026-84501Sep 16, 2026unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's
- CVE-2026-84439Sep 16, 2026When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.