Not Failing Securely ('Failing Open') in Apache Pulsar - CVE-2026-105933
Published: October 23, 2026
Vulnerability identifier: #VU157380
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105933
CWE-ID: CWE-636
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass a namespace encryption requirement and publish unencrypted messages to an affected topic.
The vulnerability exists due to fail-open error handling in persistent topic initialization when an initialization step fails and the broker loads the topic with the encryption requirement disabled. A remote user can publish unencrypted messages with permission to produce to the affected topic to have those messages accepted and stored despite the namespace encryption policy.
Messages published with encryption remain encrypted; the issue does not expose their contents or the encryption keys.
Affected software
Apache Pulsar
How to mitigate CVE-2026-105933
Install security update from vendor's website.
Apache Pulsar - addressed in versions 4.0.14, 4.2.5