Threats tagged 'ghsa-f6p9-rj89-vgmr'

CVE-2026-100252 is an improper authorization vulnerability in Apache ZooKeeper when SASL authentication is enabled. The server incorrectly grants any authorization identity requested by a client without verifying it against the authenticated principal. If the principal is not covered by the auth_to_local rules, the client can impersonate any SASL identity, including superuser accounts, gaining unauthorized access. The issue is fixed in Apache ZooKeeper versions 3.8.8 and 3.9.7.