CVE-2026-100252

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>libzookeeper -- FIXME</topic>
    <affects>
      <package>
	<name>libzookeeper</name>
	<name>zookeeper</name>
	<range><ge>3.8.0</ge><le>3.8.7</le></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-100252: Improper Authorization vulnerability in Apache
	  ZooKeeper. When SASL authentication is enabled on the client port,
	  the server's SASL callback handler grants every authorization
	  identity (authzid) that a client requests, without checking it
	  against the principal the client authenticated as. The server then
	  tries to replace the requested identity with a canonical form of
	  the authenticated principal, derived from the
	  zookeeper.security.auth_to_local rules. If no rule applies to the
	  principal, canonicalization fails and the error is only logged. The
	  client-requested authzid then becomes the session's SASL identity
	  for all ACL checks. An authenticated client whose principal is not
	  covered by the auth_to_local rules can therefore claim any SASL
	  identity. With the default rules, this includes any Kerberos
	  principal from a realm other than the server's default realm, such
	  as a principal from a cross-realm trusted realm. The client then
	  gets the permissions granted to that identity in sasl ACLs. If the
	  requested identity matches a configured zookeeper.superUser, it
	  gets superuser access to the whole data tree. Users are recommended
	  to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-100252</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-100252</url>
    </references>
    <dates>
      <discovery>2026-11-04</discovery>
      <entry>2026-11-04</entry>
    </dates>
  </vuln>