CVE-2026-105932: CWE-862 Missing Authorization in Apache Software Foundation Apache Pulsar

Apache Pulsar's broker admin REST API for non-persistent topics lacks proper authorization checks on endpoints managing topic-level entry filter policies. While persistent topic endpoints enforce authorization for entry filter policy operations, the non-persistent topic endpoints only perform an indirect permission check during partition metadata retrieval, insufficient to restrict policy management. Consequently, authenticated users with produce or consume permissions on a non-persistent topic or its namespace can modify or remove the topic-level entry filter policy, which should be restricted to tenant admins or superusers. The vulnerability's practical impact depends on two broker settings: entry filters must be installed by the operator (default directory empty) and topic-level entry filter policy override must be enabled (disabled by default). Without these, the issue has no effect. The vulnerability does not allow arbitrary code execution or message content access. It affects Apache Pulsar versions >=3.3.0 <4.0.14 and >=4.1.0 <4.2.5. Fixed versions are 4.0.14 and 4.2.5.

An authenticated user with produce or consume permissions on a non-persistent topic or its namespace can read, replace, or remove the topic-level entry filter policy, potentially altering message delivery restrictions on that topic. This could allow bypassing or changing message filtering for new subscriptions or re-created subscriptions. However, the impact is limited because entry filters must be pre-installed by the operator and topic-level overrides must be enabled, both disabled by default. The vulnerability does not allow arbitrary code execution, message content access, or affect persistent topics or namespace-level policies.

A fix is available in Apache Pulsar versions 4.0.14 and 4.2.5. Users should upgrade to at least these versions to remediate the vulnerability. For users unable to upgrade immediately who have deployed entry filters, it is recommended to keep the broker configuration setting allowOverrideEntryFilters disabled (default false) to prevent topic-level entry filter policies from affecting message dispatch. This effectively mitigates the impact of the vulnerability.