# CVE-2026-100252: Apache ZooKeeper improper authorization in SASL authentication

Source: https://junglewise.ai/threats/cve-2026-100252-improper-authorization-vulnerability-in-apache-zookeeper-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-100252 · Severity: info · Published 2026-11-04

Apache ZooKeeper is a distributed coordination service used by applications to manage configuration and synchronization. When SASL authentication is enabled, a flaw allows authenticated clients to claim any identity they request, potentially gaining superuser access to the entire data tree if their identity matches a configured superuser. This could allow an authenticated attacker to read, modify, or delete critical configuration data.

Technologies: [Apache Zookeeper](https://junglewise.ai/threats/technologies/zookeeper). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-100252 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100252 being exploited in the wild.

**How severe is CVE-2026-100252?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Apache Zookeeper before 3.8.8, before 3.9.7.

**Is there a fix for CVE-2026-100252?** Yes: fixed in ZooKeeper 3.8.8, 3.9.7. Until then: Ensure auth_to_local rules cover all expected Kerberos principals in your environment. Restrict network access to ZooKeeper client ports to trusted hosts only. Review and limit superuser identity configurations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100252 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100252?** Check whether you run Apache Zookeeper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ZooKeeper 3.8.8, 3.9.7

Ensure auth_to_local rules cover all expected Kerberos principals in your environment. Restrict network access to ZooKeeper client ports to trusted hosts only. Review and limit superuser identity configurations.

## Technical details

The SASL callback handler in ZooKeeper fails to validate that a client's requested authorization identity (authzid) matches the principal they authenticated as. When auth_to_local canonicalization fails for a principal not covered by configured rules, the client-requested identity is used for all ACL checks. An authenticated client from a cross-realm or uncovered Kerberos principal can thus claim superuser identity and bypass all access controls.

## Affected products

- Apache ZooKeeper before 3.8.8, before 3.9.7

## Timeline

- 2026-11-04: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/81rdyqlmlp3dtkkqgp8t5080g3b9r2pj](https://lists.apache.org/thread.html/81rdyqlmlp3dtkkqgp8t5080g3b9r2pj)

## Related threats

- [Apache ZooKeeper uncontrolled recursion in snapshot serialization](https://junglewise.ai/threats/cve-2026-115448-uncontrolled-recursion-in-apache-zookeeper-the-server-serializes)
- [Apache ZooKeeper denial of service in multiRead handler](https://junglewise.ai/threats/cve-2026-100302-allocation-of-resources-without-limits-or-throttling-in-the)
- [Apache ZooKeeper quota subsystem denial of service](https://junglewise.ai/threats/cve-2026-100300-improper-handling-of-exceptional-conditions-in-the-quota)
- [Apache ZooKeeper setACL time-of-check time-of-use race condition](https://junglewise.ai/threats/cve-2026-100235-incorrect-authorization-due-to-a-time-of-check-to-time-of-use)
- [Apache ZooKeeper log injection via crafted add_auth request](https://junglewise.ai/threats/cve-2026-84501-apache-zookeeper-log-injection-via-crafted-add-auth-request)