Missing Authorization in Apache Pulsar - CVE-2026-105938
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to bypass subscription authorization policies to clear subscription backlogs, expire messages, or delete subscriptions without permission to access those subscriptions.
The vulnerability exists due to missing subscription authorization checks in Apache Pulsar's admin REST API when handling namespace-level and bundle-level clear backlog and unsubscribe operations and topic-level expire-all operations. A remote user can submit these operations with consume permission on the relevant namespace or topic to modify otherwise restricted subscription state, causing unacknowledged messages to be skipped or subscriptions without connected consumers to be deleted.
Namespaces that do not configure Prefix subscription authentication mode or subscription permissions are not affected by this bypass.