CVE-2026-105869: CWE-347 Improper Verification of Cryptographic Signature in Apache Software Foundation Apache Pulsar

The vulnerability (CVE-2026-105869) in Apache Pulsar's MultiRolesTokenAuthorizationProvider arises because it authorizes clients based on roles extracted from JWT claims without verifying the token's cryptographic signature if the token authentication fails and fallback to an anonymous user role is enabled. This occurs for HTTP endpoints and WebSocket API requests when strictAuthMethod is false (default). An attacker can send a forged or unsigned token listing arbitrary roles, including super-user roles, to gain unauthorized access and control over broker resources. The flaw does not affect the default PulsarAuthorizationProvider or connections using the Pulsar binary protocol. Fixed versions ensure roles are obtained only from tokens verified by the configured token authentication provider, and anonymous user role fallback does not grant additional roles. The broker also fails to start if configured improperly without a token authentication provider.

An unauthenticated attacker can gain unauthorized access with arbitrary roles, including super-user privileges, on affected Apache Pulsar brokers. This can lead to unauthorized reading and modification of tenants, namespaces, topics, permissions, and broker configuration via HTTP and WebSocket APIs. The vulnerability compromises the integrity and confidentiality of the broker's authorization controls. Deployments using default authorization or without anonymousUserRole are not impacted. Successful authentication with valid tokens remains secure.

A fix is available in Apache Pulsar versions 4.0.14 and 4.2.5 and later. Users should upgrade to these versions or newer. If immediate upgrade is not possible, users can mitigate by removing the anonymousUserRole setting from broker and WebSocket service configurations or restricting network access to HTTP endpoints to trusted clients. The broker will fail to start if MultiRolesTokenAuthorizationProvider is configured with authorization enabled but without a token authentication provider, preventing misconfiguration.