# CVE-2026-100252

Auth bypass in Apache ZooKeeper allows SASL identity spoofing and potential full data-tree takeover.

- Page: https://www.vulneraibility.com/cve/CVE-2026-100252
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-04)
- Weakness: CWE-863
- Published: 2026-11-04

## Affected versions

- Apache Software Foundation Apache ZooKeeper: affected >= 3.9.0 and <= 3.9.6; >= 3.8.0 and <= 3.8.7

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated SASL client can claim arbitrary authzid, bypass ACLs, and gain superuser/full data-tree access.

## Action

Immediate action required

## Recommendation

Upgrade to 3.8.8 or 3.9.7 immediately; restrict SASL client access and review ACLs.

## References

- [advisory] https://lists.apache.org/thread.html/81rdyqlmlp3dtkkqgp8t5080g3b9r2pj
- [other] http://www.openwall.com/lists/oss-security/2026/11/03/10

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.