Cyber ·
CVE-2026-100252: SASL authorization bypass in Apache ZooKeeper (CVSS 8.6)
A flaw in Apache ZooKeeper lets a client, with SASL enabled on the client port, obtain any requested authorization identity, bypassing authorization. Versions 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7 are affected.
According to the advisory published on the oss-sec mailing list on November 3, 2026 by Andor Molnar, CVE-2026-100252 affects Apache ZooKeeper when SASL authentication is enabled on the client port. In this case, the server's SASL callback handler grants every authorization identity (authzid) a client requests, which allows bypassing authorization. The severity is rated as important, with a CVSS 4.0 score of 8.6 (high), network attack vector, low complexity, no user interaction, low privileges, and high confidentiality and integrity impact. Affected versions are 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7. The available text is a machine translation and is truncated, so the full description should be checked at the source. To verify, consult the original advisory on the oss-sec list and the fix notes published by the Apache ZooKeeper project, and confirm the installed version on each server.