https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 06 Nov 2026 12:45:29 +0000 https://db.gcve.eu/vuln/cve-2026-100252 <p><strong>Affected:</strong> Apache Software Foundation Apache ZooKeeper</p> <p>Improper Authorization vulnerability in Apache ZooKeeper.</p> <p>When SASL authentication is enabled on the client port, the server&#39;s SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session&#39;s SASL identity for all ACL checks.</p> <p>An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server&#39;s default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.</p> <p>Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache ZooKeeper</p> <p>Improper Authorization vulnerability in Apache ZooKeeper.</p> <p>When SASL authentication is enabled on the client port, the server&#39;s SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session&#39;s SASL identity for all ACL checks.</p> <p>An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server&#39;s default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.</p> <p>Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.</p> https://db.gcve.eu/vuln/cve-2026-100252