SB2026102314 - Multiple vulnerabilities in Apache Pulsar

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102314

SB2026102314 - Multiple vulnerabilities in Apache Pulsar

Published: October 23, 2026

Security Bulletin ID SB2026102314
CSH Severity
High
Patch available
YES
Number of vulnerabilities 14
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 7% Medium 21% Low 71%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 14 vulnerabilities.


1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-105869)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authorization restrictions and potentially gain super-user access to read and modify tenants, namespaces, topics, permissions, and broker configuration.

The vulnerability exists due to improper verification of cryptographic signatures in Apache Pulsar's MultiRolesTokenAuthorizationProvider when authorizing HTTP requests whose failed authentication falls back to the anonymous user role. A remote attacker can send a request to the admin REST API or WebSocket API with a forged or unsigned bearer token containing arbitrary roles to obtain authorization as those roles, including super-user access if a listed role is configured in superUserRoles.


2) Missing Authorization (CVE-ID: CVE-2026-105926)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose topic schema definitions and register unauthorized schema versions across namespaces or tenants, potentially disrupting legitimate producers and consumers.

The vulnerability exists due to missing topic authorization checks in the Apache Pulsar broker when handling binary protocol GetSchema and GetOrCreateSchema commands. A remote user can send these commands directly without an authorized topic lookup to read schemas or register new schema versions for existing topics without permission on the target topic, namespace, or tenant. Unauthorized schema registration remains subject to schema compatibility and auto-update policies, but can cause legitimate producers and consumers to fail with schema incompatibility errors. Message data cannot be read or modified through this issue, and the schema REST API endpoints are not affected.

The issue is relevant only to deployments with authentication and authorization enabled.


3) Missing Authorization (CVE-ID: CVE-2026-105927)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject messages into topics without PRODUCE permission and consume storage and backlog capacity in the target namespace.

The vulnerability exists due to a missing authorization check in the Apache Pulsar WebSocket consumer endpoint when processing the deadLetterTopic query parameter. A remote user can use CONSUME permission on a subscribed topic to configure a dead letter destination and cause messages exceeding the maximum redelivery count to be written using the WebSocket service's broker client identity, bypassing the user's PRODUCE permissions. The destination must be in an existing namespace, permit the service identity to produce, and accept a producer that registers no schema.

Exploitation requires the WebSocket service to be enabled, either within the broker or as a standalone WebSocket proxy. The broker's webSocketServiceEnabled setting is disabled by default.


4) Incorrect authorization (CVE-ID: CVE-2026-105930)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose package contents belonging to another tenant, potentially exposing application code, business logic or embedded credentials.

The vulnerability exists due to improper authorization in the Apache Pulsar Functions worker when processing package URLs during function, source or sink registration or updates, including sink transform functions. A remote user can supply a URL referencing a package in another tenant's namespace while registering or updating a component in an authorized namespace to retrieve that package using the worker's credentials without having permission to access it.

Affected deployments must have authentication, authorization and package management enabled, including the broker setting enablePackagesManagement and, in current releases, the worker setting functionsWorkerEnablePackageManagement. Both package management settings are disabled by default.


5) Missing Authorization (CVE-ID: CVE-2026-105931)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose transaction-related metadata and statistics belonging to other tenants and determine whether a named topic exists in another tenant.

The vulnerability exists due to missing authorization checks in the Apache Pulsar broker's transaction administration REST API under /admin/v3/transactions when handling read requests. A remote user can send requests for resources belonging to other tenants without having permissions for those resources to obtain transaction coordinator information, transaction metadata, and transaction buffer and pending acknowledgement statistics, or infer topic existence from an error response.

Disclosure of transaction metadata and statistics requires transactionCoordinatorEnabled to be enabled in the broker; this setting is disabled by default.


6) Missing Authorization (CVE-ID: CVE-2026-105932)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read or modify non-persistent topic entry filter policies without authorization, potentially bypassing message delivery restrictions or preventing message delivery.

The vulnerability exists due to missing authorization checks in the Apache Pulsar broker admin REST API endpoint /admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters when handling topic-level entry filter policy requests. A remote user can use produce or consume permission on a non-persistent topic or its namespace to read, replace or remove the topic's entry filter policy without permission to manage topic policies. Policy changes can affect message dispatch only when operator-installed entry filters are available and allowOverrideEntryFilters is enabled.

Policy changes affect only subscription dispatchers created after the change; existing dispatchers retain their original entry filters.


7) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-105933)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass a namespace encryption requirement and publish unencrypted messages to an affected topic.

The vulnerability exists due to fail-open error handling in persistent topic initialization when an initialization step fails and the broker loads the topic with the encryption requirement disabled. A remote user can publish unencrypted messages with permission to produce to the affected topic to have those messages accepted and stored despite the namespace encryption policy.

Messages published with encryption remain encrypted; the issue does not expose their contents or the encryption keys.


8) Missing Authorization (CVE-ID: CVE-2026-105934)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to truncate partitioned topics without tenant administrator authorization, causing consumers to skip unacknowledged messages and potentially causing permanent message loss.

The vulnerability exists due to a missing caller authorization check in the Apache Pulsar broker admin REST API when processing truncate requests for partitioned topic names. A remote user can send a DELETE request to /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate for a partitioned topic on which they have lookup permission to truncate all its partitions through the broker's internal admin client, advancing subscription cursors and deleting eligible older ledgers.


9) Missing Authorization (CVE-ID: CVE-2026-105935)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to publish unauthorized messages to function input topics, including topics in other tenants.

The vulnerability exists due to missing authorization checks in the Apache Pulsar Functions Worker trigger REST API endpoint when publishing caller-supplied content to a function's input topic. A remote user can trigger a function in a namespace where they have permission to manage functions to publish controlled content using the Worker's broker-client identity without having produce permission on the selected topic.


10) Missing Authorization (CVE-ID: CVE-2026-105936)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read the installed Pulsar IO connector catalog without super-user access.

The vulnerability exists due to a missing authorization check in the Apache Pulsar Functions connectors endpoints when handling connector catalog requests with authorization enabled. A remote user can request /admin/v2/functions/connectors or /admin/v3/functions/connectors to obtain connector names, descriptions, and source, sink and configuration class names regardless of the permissions granted to their role.

The disclosed catalog does not contain configured source or sink instances, configuration values or credentials. An installed connector type does not indicate that the connector is configured or running.


11) Missing Authorization (CVE-ID: CVE-2026-105937)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to disclose messages across tenants, register new schema versions for a source topic, and permanently delete source topic data.

The vulnerability exists due to missing authorization checks on the source topic in the Apache Pulsar admin REST API when creating topics or updating topic properties containing PULSAR.SHADOW_SOURCE. A remote privileged user can bind a topic they control to another tenant's persistent source topic without permission on that source, consume its messages through the shadow topic, and register new source schema versions through a shadow-topic producer; shadow-topic ledger lifecycle operations can also delete the source topic's data independently of its subscriptions and retention policy.


12) Missing Authorization (CVE-ID: CVE-2026-105938)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass subscription authorization policies to clear subscription backlogs, expire messages, or delete subscriptions without permission to access those subscriptions.

The vulnerability exists due to missing subscription authorization checks in Apache Pulsar's admin REST API when handling namespace-level and bundle-level clear backlog and unsubscribe operations and topic-level expire-all operations. A remote user can submit these operations with consume permission on the relevant namespace or topic to modify otherwise restricted subscription state, causing unacknowledged messages to be skipped or subscriptions without connected consumers to be deleted.

Namespaces that do not configure Prefix subscription authentication mode or subscription permissions are not affected by this bypass.


13) Incorrect authorization (CVE-ID: CVE-2026-105942)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges by exercising permissions granted to a proxy rather than the original principal.

The vulnerability exists due to incorrect authorization in Apache Pulsar's broker and functions worker when authorizing the original principal of a proxied request using the proxy's authentication data. A remote user can submit requests through a proxy whose token grants elevated roles to perform operations beyond their own permissions when MultiRolesTokenAuthorizationProvider is used; custom authorization providers that use authentication data may be similarly affected.


14) Path traversal (CVE-ID: CVE-2026-105945)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to download, overwrite or delete packages in other tenants or namespaces without authorization, potentially compromising the integrity and availability of Pulsar Functions, Sources or Sinks that use those packages.

The vulnerability exists due to path traversal in the Apache Pulsar filesystem package storage provider when resolving package names containing unvalidated version components. A remote user can submit package operations with URL-encoded path separators and parent directory references in the version component, using packages permission on any namespace to access or modify packages belonging to other tenants or namespaces.

Exploitation requires package management to be enabled through enablePackagesManagement and FileSystemPackagesStorageProvider to be selected through packagesManagementStorageProvider.


Remediation

Install update from vendor's website.

References