Missing Authorization in Apache Pulsar - CVE-2026-105937
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote privileged user to disclose messages across tenants, register new schema versions for a source topic, and permanently delete source topic data.
The vulnerability exists due to missing authorization checks on the source topic in the Apache Pulsar admin REST API when creating topics or updating topic properties containing PULSAR.SHADOW_SOURCE. A remote privileged user can bind a topic they control to another tenant's persistent source topic without permission on that source, consume its messages through the shadow topic, and register new source schema versions through a shadow-topic producer; shadow-topic ledger lifecycle operations can also delete the source topic's data independently of its subscriptions and retention policy.