CVE-2026-100252

Vendor

Apache Software Foundation

Product

Apache ZooKeeper

CVSS v4.0

8.6 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-863

Exposure class

Database

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 35
   CVE NVD 1h ago

   Improper Authorization vulnerability in Apache ZooKeeper.

   Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without…

   CVSS 8.6 Fix available CVE-2026-100252 Apache Software Foundation