CVE-2026-100252High· 8.6▾ TwilightImproper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
Improper Authorization vulnerability in Apache ZooKeeper.
When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.
An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.
Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
org.apache.zookeeper:zookeeper >= 3.9.0 <= 3.9.6org.apache.zookeeper:zookeeper >= 3.8.0 <= 3.8.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100235Medium· 6.0Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
CVE-2026-100300High· 8.7Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
CVE-2026-115448High· 8.7Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
CVE-2026-100302High· 7.1Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
CVE-2025-67740Low· 2.7In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
CVE-2020-3578Medium· 5.3A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and ac…