Apache
CVE-2026-100252: Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants eve
CVE-2026-100252 Nov 4, 2026 Source: Vendor
Improper Authorization vulnerability in Apache ZooKeeper.
When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canon
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-100252
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2
CVE-2026-100252
BR2026-0000-042215
unclaimed
Credited as cunyi li
CVE-2026-100252
BR2026-0000-042216
unclaimed
Credited as Prasath Jayasundar & PayPal Cyber Security Team