CVE-2026-105931: CWE-862 Missing Authorization in Apache Software Foundation Apache Pulsar
Description
Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5 have a missing authorization vulnerability in the transaction administration REST API. Authenticated users without permissions can read transaction metadata and statistics across tenant boundaries when transaction support is enabled. The vulnerability does not allow modification of transactions or access to message contents. Transaction support is disabled by default, limiting exposure if not used.
CVSS v4.0
Score 2.3low
Affected software
Apache Software Foundation
Apache Pulsar
pkg:maven/org.apache.pulsar/pulsarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Apache Pulsar broker's transaction administration REST API under /admin/v3/transactions improperly authorizes read endpoints when authentication and authorization are enabled. These endpoints verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator but do not check tenant, namespace, or topic access permissions. Consequently, any authenticated user, even without permissions, can access transaction coordinator information, transaction metadata, statistics, and other transaction-related data belonging to other tenants. Endpoints that modify state require super-user access and are unaffected. This disclosure risk occurs only if transaction support is enabled (transactionCoordinatorEnabled). If disabled, no transaction data is returned, though an error response may reveal topic existence in other tenants. The vulnerability affects Apache Pulsar versions >=2.8.0 <4.0.14 and >=4.1.0 <4.2.5.
Potential Impact
The vulnerability allows unauthorized disclosure of transaction-related metadata and statistics across tenant boundaries in Apache Pulsar when transaction support is enabled. It does not permit reading message contents, modifying or aborting transactions, or changing configurations. The impact is limited to information disclosure of transaction internals, which could aid an attacker in understanding tenant activity or broker internals but does not directly compromise data integrity or confidentiality of message payloads.
Mitigation Recommendations
A fix is available by upgrading Apache Pulsar to at least version 4.0.14 for the 4.0.x line or at least 4.2.5 for the 4.1.x and 4.2.x lines. Users on earlier versions should upgrade to these patched versions or newer. If immediate upgrade is not possible and transaction support is not required, keep transaction support disabled (transactionCoordinatorEnabled=false) to avoid exposure. Additionally, restricting network access to the broker's admin HTTP endpoints to trusted administrative clients can reduce exposure where transactions are required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-10-06T06:37:10.499Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad9050d4d27ba8daadc99a2
Added to database: 10/21/2026, 18:31:41 UTC
Last enriched: 10/21/2026, 19:00:35 UTC
Last updated: 10/21/2026, 19:00:35 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.