CVE-2026-100252: Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
Improper Authorization vulnerability in Apache ZooKeeper.
When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.authtolocal rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.
An authenticated client whose principal is not covered by the authtolocal rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.
Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.8.8 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.7
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker must be able to authenticate to the ZooKeeper client port using SASL and have a principal that is not matched by the configured zookeeper.security.auth_to_local rules. With the default rules, this can include Kerberos principals from a cross-realm trusted realm other than the server's default realm.
What level of access could an attacker obtain?
The attacker can request any SASL identity and receive the permissions assigned to that identity by sasl ACLs. If they request an identity configured as zookeeper.superUser, they can obtain superuser access across the entire data tree.
Are default configurations affected?
Yes. Under the default auth_to_local rules, an authenticated Kerberos principal from a non-default but cross-realm trusted realm may not be canonicalized, allowing the client-supplied authorization identity to be used for ACL checks.
What should be done to remediate the issue?
Upgrade Apache ZooKeeper to version 3.8.8 or 3.9.7, which fix the vulnerability.