Bug 2566833 (CVE-2026-100252)

Summary:	CVE-2026-100252 org.apache.zookeeper/zookeeper: zookeeper: Privilege escalation via improper SASL authorization identity validation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asyoung, csuconic, dbruscin, gmalinko, gtully, janstey, jhollowa, jsherman, kvanderr, pdelbell, prichard, rgemmell, rgodfrey, rstepani, sthirugn, tbish, tlavocat
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache ZooKeeper. When Simple Authentication and Security Layer (SASL) authentication is enabled, the server fails to properly validate the authorization identity requested by a client against its authenticated credentials. An authenticated remote client can exploit this flaw by requesting an arbitrary identity when local mapping rules do not match the authenticated principal. This can lead to privilege escalation, allowing the attacker to gain unauthorized access or superuser administrative control over the entire ZooKeeper data tree.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-04 10:55:57 UTC

Improper Authorization vulnerability in Apache ZooKeeper.

When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.

An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.

Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.