Incorrect authorization in Apache Pulsar - CVE-2026-105930
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to disclose package contents belonging to another tenant, potentially exposing application code, business logic or embedded credentials.
The vulnerability exists due to improper authorization in the Apache Pulsar Functions worker when processing package URLs during function, source or sink registration or updates, including sink transform functions. A remote user can supply a URL referencing a package in another tenant's namespace while registering or updating a component in an authorized namespace to retrieve that package using the worker's credentials without having permission to access it.
Affected deployments must have authentication, authorization and package management enabled, including the broker setting enablePackagesManagement and, in current releases, the worker setting functionsWorkerEnablePackageManagement. Both package management settings are disabled by default.