Apache ZooKeeper CVE-2026-100252

Requires SASL authentication enabled on the ZooKeeper client port AND an attacker holding a valid authenticated principal whose identity is NOT matched by the configured zookeeper.security.auth_to_local rules - with the default rules this specifically means any Kerberos principal from a realm other than the server's default realm, such as one from a cross-realm trusted realm. The escalation to full superuser requires that the claimed authzid match a configured zookeeper.superUser; otherwise the attacker only gains whatever that claimed identity holds in sasl ACLs. Limiting factors: exploitation is impossible without SASL on the client port, requires the attacker to already authenticate (PR:L - not anonymous), and deployments that do not use cross-realm trust or whose principals are all covered by auth_to_local rules are not exposed. The only complete fix per the vendor is upgrading to 3.8.8 or 3.9.7.

This is a genuine authorization-bypass priority for Kerberos/SASL-secured ZooKeeper ensembles, but its reach is gated by a specific precondition rather than being broadly remote-unauthenticated. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 (high): network vector, low complexity, no attack requirements, but PR:L - meaning the attacker must already hold valid SASL credentials (an authenticated client), with high confidentiality and integrity impact and no availability impact. That maps to a high-impact privilege-escalation/impersonation flaw rather than a wormable pre-auth RCE. Decision label is 'awaiting_data', and no EPSS score, no CISA KEV listing, and no proof-of-concept reference are present in the provided intelligence, so there is no signal of active or probable exploitation at this time - exploitation status must be read as unproven, not as low-risk-by-confirmation. The impact ceiling is severe: an authenticated client whose principal escapes the auth_to_local rules (e.g., a cross-realm principal) can claim any SASL identity, and if that identity matches a configured zookeeper.superUser it obtains superuser access to the entire data tree, which for ZooKeeper typically underpins Kafka/Hadoop/HBase control-plane data. Net: treat as a high priority for environments using SASL on the client port with cross-realm trust; the PR:L requirement and the specific auth_to_local/cross-realm precondition are what keep this from being a universal emergency.

An attacker who holds a valid Kerberos principal from a realm that is trusted cross-realm but not covered by the server's default auth_to_local rules connects to the SASL-enabled client port and, during authentication, supplies an authorization ID (authzid) of a privileged identity. The server fails to canonicalize the unmatched principal, silently logs the error, and accepts the client-requested authzid as the session identity, so the attacker inherits that identity's sasl ACL permissions. No public proof-of-concept is referenced in the available data; the low attack complexity (AC:L) means exploitation is straightforward once the cross-realm authentication precondition is met.