Posted by Andor Molnar on Nov 03 Severity: important CVSS 4.0: 8.6 (high) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Affected versions: - Apache ZooKeeper 3.9.0 through 3.9.6 - Apache ZooKeeper 3.8.0 through 3.8.7 Description: Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests,...
CVE-2026-100252: Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/485
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
arXiv:2611.06477v1 Announce Type: new Abstract: Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce…
Node.js security release pre-alert
Posted by Antoine du Hamel on Nov 04 We will release new versions of Node.js 22, 24, and 26 release lines on or shortly after 2026-11-11 in order to address security…
Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw
The rsync project released version 3.5.2, and it closes a flaw that let a connecting client tie up a server’s CPU with checksum math that leads nowhere. The new version…
Fixed Detectors, Moving Code: How Well Do Static Security Analyzers Hold Up over a Decade of C/C++ Evolution?
arXiv:2611.03742v1 Announce Type: new Abstract: Static application security testing (SAST) tools are often deployed on the assumption that detectors configured today…
When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation
arXiv:2611.04289v1 Announce Type: new Abstract: Retrieval-augmented Web applications increasingly employ multi-agent debate (MAD) to aggregate conflicting, noisy, and…
CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables
Posted by Arrigo Marchiori on Nov 03 Severity: important Affected versions: - Apache OpenOffice through 4.1.16 Description: Apache OpenOffice documents can contain…