Missing Authorization in Apache Pulsar - CVE-2026-105935
Published: October 23, 2026
Vulnerability identifier: #VU157382
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105935
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to publish unauthorized messages to function input topics, including topics in other tenants.
The vulnerability exists due to missing authorization checks in the Apache Pulsar Functions Worker trigger REST API endpoint when publishing caller-supplied content to a function's input topic. A remote user can trigger a function in a namespace where they have permission to manage functions to publish controlled content using the Worker's broker-client identity without having produce permission on the selected topic.
Affected software
Apache Pulsar
How to mitigate CVE-2026-105935
Install security update from vendor's website.
Apache Pulsar - addressed in versions 4.0.14, 4.2.5