Quick answers
- Is CVE-2026-100252 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-100252 being exploited in the wild.
- How severe is CVE-2026-100252?
- Informational severity, published 4 November 2026.
- Which products and versions are affected?
- Apache Zookeeper before 3.8.8, before 3.9.7.
- Is there a fix for CVE-2026-100252?
- Yes: fixed in ZooKeeper 3.8.8, 3.9.7. Until then: Ensure auth_to_local rules cover all expected Kerberos principals in your environment. Restrict network access to ZooKeeper client ports to trusted hosts only. Review and limit superuser identity configurations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-100252 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-100252?
- Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: ZooKeeper 3.8.8, 3.9.7
Ensure auth_to_local rules cover all expected Kerberos principals in your environment. Restrict network access to ZooKeeper client ports to trusted hosts only. Review and limit superuser identity configurations.
Technical details
The SASL callback handler in ZooKeeper fails to validate that a client's requested authorization identity (authzid) matches the principal they authenticated as. When auth_to_local canonicalization fails for a principal not covered by configured rules, the client-requested identity is used for all ACL checks. An authenticated client from a cross-realm or uncovered Kerberos principal can thus claim superuser identity and bypass all access controls.
Affected products
- Apache ZooKeeper before 3.8.8, before 3.9.7
Timeline
- 2026-11-04: disclosed