Improper Verification of Cryptographic Signature in Apache Pulsar - CVE-2026-105869
Published: October 23, 2026
Vulnerability identifier: #VU157374
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105869
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization restrictions and potentially gain super-user access to read and modify tenants, namespaces, topics, permissions, and broker configuration.
The vulnerability exists due to improper verification of cryptographic signatures in Apache Pulsar's MultiRolesTokenAuthorizationProvider when authorizing HTTP requests whose failed authentication falls back to the anonymous user role. A remote attacker can send a request to the admin REST API or WebSocket API with a forged or unsigned bearer token containing arbitrary roles to obtain authorization as those roles, including super-user access if a listed role is configured in superUserRoles.
Affected software
Apache Pulsar
How to mitigate CVE-2026-105869
Install security update from vendor's website.
Apache Pulsar - addressed in versions 4.0.14, 4.2.5