Missing Authorization in Apache Pulsar - CVE-2026-105926
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to disclose topic schema definitions and register unauthorized schema versions across namespaces or tenants, potentially disrupting legitimate producers and consumers.
The vulnerability exists due to missing topic authorization checks in the Apache Pulsar broker when handling binary protocol GetSchema and GetOrCreateSchema commands. A remote user can send these commands directly without an authorized topic lookup to read schemas or register new schema versions for existing topics without permission on the target topic, namespace, or tenant. Unauthorized schema registration remains subject to schema compatibility and auto-update policies, but can cause legitimate producers and consumers to fail with schema incompatibility errors. Message data cannot be read or modified through this issue, and the schema REST API endpoints are not affected.
The issue is relevant only to deployments with authentication and authorization enabled.