An authenticated client whose principal is not covered by the zookeeper.security.auth_to_local rules is exposed to this bypass. With the default rules, this includes Kerberos principals from a realm other than the server's default realm, such as principals from a cross-realm trusted realm.
SASL authentication must be enabled on the ZooKeeper client port. The authenticated principal must also lack a matching auth_to_local rule, allowing canonicalization to fail while the client-supplied authorization identity remains in use for ACL checks.
The client can claim an arbitrary SASL identity and receive the permissions assigned to that identity by ZooKeeper ACLs. This can affect confidentiality and integrity, as reflected in the supplied CVSS vector.