CVE-2026-100252
Description
A flaw was found in Apache ZooKeeper. When Simple Authentication and Security Layer (SASL) authentication is enabled, the server fails to properly validate the authorization identity requested by a client against its authenticated credentials. An authenticated remote client can exploit this flaw by requesting an arbitrary identity when local mapping rules do not match the authenticated principal. This can lead to privilege escalation, allowing the attacker to gain unauthorized access or superuser administrative control over the entire ZooKeeper data tree.
Statement
This vulnerability is rated as an Important severity flaw because an authenticated remote user with an unmapped Kerberos principal can claim arbitrary authorization identities, potentially gaining administrative superuser control over cluster data. In Red Hat environments, ZooKeeper typically coordinates infrastructure services across restricted network segments. Exploitation requires client-facing SASL authentication to be active alongside cross-realm trusts or foreign Kerberos identities that lack dedicated auth_to_local translation definitions. Single-realm environments or installations with exhaustive principal mappings are not susceptible to this identity assumption.
Mitigation
1. Network Access Control:
Restrict network reachability to the ZooKeeper client port (default TCP 2181) so that only trusted client nodes and application services can connect. On Red Hat Enterprise Linux systems running firewalld, restrict access to a dedicated trusted zone:
firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET> --permanent
firewall-cmd --zone=trusted --add-port=2181/tcp --permanent
firewall-cmd --reload
Warning: Reloading firewalld applies new firewall rules immediately and can disrupt active network sessions if misconfigured.
2. Configuration Hardening:
Explicitly configure 'zookeeper.security.auth_to_local' mapping rules in zoo.cfg to handle all legitimate Kerberos realms and principals, ensuring that canonicalization succeeds for all accepted accounts rather than failing open.
Caveats:
Network restriction reduces the attack surface from untrusted networks but does not prevent abuse from authenticated clients on authorized networks if cross-realm principals remain unmapped.
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate client-requested authorization identities against authenticated credentials in the ZooKeeper SASL callback handler: upgrade to ZooKeeper 3.8.8, 3.9.7 (or the corresponding fixed Red Hat builds), which validates requested authorization identities against authenticated credentials and prevents unmapped Kerberos principals from falling back to client-supplied authorization identities, closing all 2 injection vectors (arbitrary authzid specification during SASL negotiation, superuser identity impersonation via cross-realm Kerberos principal). Until patched, this is only a concern on ZooKeeper deployments with SASL authentication enabled on the client port handling unmapped or cross-realm principals — Single-realm environments or installations with exhaustive principal mappings covering all authenticating clients are unaffected — so Restrict network access to ZooKeeper client port TCP 2181 to trusted hosts and configure explicit zookeeper.security.auth_to_local rules for all legitimate Kerberos realms and principals. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper authorization identity validation flaw — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
