Vulnerabilityhigh
Apache ZooKeeper SASL authorization bypass on client port (CVE-2026-100252)
Original title: CVE-2026-100252: Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
AI summary · x-ai/grok-4.7Summaries by Vani AI
Affects 3.8.0-3.9.6; client-supplied authzid bypasses SASL checks
Apache ZooKeeper has a vulnerability in its SASL authorization for the client port. When SASL is enabled, the server grants authorization to any authzid requested by the client. This affects versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6.
Key facts
- Allows arbitrary authorization identity
- Impacts client port SASL
- Bypass of authorization checks
Security assessment · AI, from the article
Impact: Unauthorized access or data exposure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100252 | — | — | — |
From the original article
Posted by Andor Molnar on Nov 03 Severity: important CVSS 4. 0: 8. 6 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.