Missing Authorization in Apache Pulsar - CVE-2026-105934
Published: October 23, 2026
Vulnerability identifier: #VU157381
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105934
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to truncate partitioned topics without tenant administrator authorization, causing consumers to skip unacknowledged messages and potentially causing permanent message loss.
The vulnerability exists due to a missing caller authorization check in the Apache Pulsar broker admin REST API when processing truncate requests for partitioned topic names. A remote user can send a DELETE request to /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate for a partitioned topic on which they have lookup permission to truncate all its partitions through the broker's internal admin client, advancing subscription cursors and deleting eligible older ledgers.
Affected software
Apache Pulsar
How to mitigate CVE-2026-105934
Install security update from vendor's website.
Apache Pulsar - addressed in versions 4.0.14, 4.2.5