The vulnerability permits an authenticated client that connects to the ZooKeeper client port using SASL to request an arbitrary authorization identity (authzid). The server accepts the requested identity without verifying it against the authenticated principal, then attempts to canonicalize it using auth_to_local rules. If canonicalization fails, the server logs the error but still uses the requested authzid as the session’s SASL identity for all ACL checks. Consequently, the client can assume any Kerberos principal, including principals from cross‑realm trusted environments, and obtain the permissions granted to that identity. If the requested identity matches a configured superuser, the attacker gains unrestricted access to the entire ZooKeeper data tree.

Apache ZooKeeper supplied by the Apache Software Foundation. Versions prior to 3.8.8 and 3.9.7 are vulnerable; the patched releases 3.8.8 and 3.9.7 contain the fix. Any deployment that has SASL authentication enabled on the client port and uses default or missing auth_to_local rules is at risk.

With a CVSS score of 8.6, the vulnerability poses a high impact. EPSS data is unavailable, and it is not listed in CISA’s KEV catalog, so the current exploit likelihood is uncertain but potential for exploitation exists. The likely attack vector is a remote client that establishes a SASL connection to the ZooKeeper client port, supplies a fabricated authzid, and relies on the server to accept it. Successful exploitation yields elevated privileges, potentially granting full administration of ZooKeeper resources.