Missing Authorization in Apache Pulsar - CVE-2026-105936
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to read the installed Pulsar IO connector catalog without super-user access.
The vulnerability exists due to a missing authorization check in the Apache Pulsar Functions connectors endpoints when handling connector catalog requests with authorization enabled. A remote user can request /admin/v2/functions/connectors or /admin/v3/functions/connectors to obtain connector names, descriptions, and source, sink and configuration class names regardless of the permissions granted to their role.
The disclosed catalog does not contain configured source or sink instances, configuration values or credentials. An installed connector type does not indicate that the connector is configured or running.