Missing Authorization in Apache Pulsar - CVE-2026-105931
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to disclose transaction-related metadata and statistics belonging to other tenants and determine whether a named topic exists in another tenant.
The vulnerability exists due to missing authorization checks in the Apache Pulsar broker's transaction administration REST API under /admin/v3/transactions when handling read requests. A remote user can send requests for resources belonging to other tenants without having permissions for those resources to obtain transaction coordinator information, transaction metadata, and transaction buffer and pending acknowledgement statistics, or infer topic existence from an error response.
Disclosure of transaction metadata and statistics requires transactionCoordinatorEnabled to be enabled in the broker; this setting is disabled by default.