CVE-2026-100252

Apache ZooKeeper contains an Improper Authorization vulnerability where the SaslServerCallbackHandler grants any client-supplied authorization identity (authzid ) without verifying it against the authenticated principal. This occurs when SASL authentication is enabled on the client port. If a cli...