Missing Authorization in Apache Pulsar - CVE-2026-105927
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to inject messages into topics without PRODUCE permission and consume storage and backlog capacity in the target namespace.
The vulnerability exists due to a missing authorization check in the Apache Pulsar WebSocket consumer endpoint when processing the deadLetterTopic query parameter. A remote user can use CONSUME permission on a subscribed topic to configure a dead letter destination and cause messages exceeding the maximum redelivery count to be written using the WebSocket service's broker client identity, bypassing the user's PRODUCE permissions. The destination must be in an existing namespace, permit the service identity to produce, and accept a producer that registers no schema.
Exploitation requires the WebSocket service to be enabled, either within the broker or as a standalone WebSocket proxy. The broker's webSocketServiceEnabled setting is disabled by default.