Missing Authorization in Apache Pulsar - CVE-2026-105932
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to read or modify non-persistent topic entry filter policies without authorization, potentially bypassing message delivery restrictions or preventing message delivery.
The vulnerability exists due to missing authorization checks in the Apache Pulsar broker admin REST API endpoint /admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters when handling topic-level entry filter policy requests. A remote user can use produce or consume permission on a non-persistent topic or its namespace to read, replace or remove the topic's entry filter policy without permission to manage topic policies. Policy changes can affect message dispatch only when operator-installed entry filters are available and allowOverrideEntryFilters is enabled.
Policy changes affect only subscription dispatchers created after the change; existing dispatchers retain their original entry filters.