-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: Security
-
None
-
Server Security
-
Fully Compatible
-
ALL
-
Server Security 2026-02-13, Server Security 2026-02-27, Server Security 2026-03-13, Server Security 2026-03-27, Server Security 2026-04-10, Server Security 2026-04-24, Server Security 2026-05-08, Server Security 2026-05-22, Server Security 2026-06-05, Server Security 2026-06-19
-
200
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Even when SCRAM-SHA-256 is disabled on the server, we still seem to allow nodes to select the auth mech in SaslSupportedMechanisms.
If the client does not specify a mechanism, we should only use an enabled mechanism. If the client specifies a disabled mechanism, we should return an error during SaslSupportedMechanisms.