CVE-2026-105933: CWE-636 Not Failing Securely ('Failing Open') in Apache Software Foundation Apache Pulsar

Apache Pulsar allows administrators to enforce end-to-end message encryption per namespace via the encryption_required policy. However, if the broker encounters an error during topic initialization (e.g., reading metadata or topic-level policies), it logs a warning and disables the encryption requirement for that topic, completing the load as successful. This results in the broker accepting unencrypted messages on topics that should enforce encryption. The issue persists if the underlying cause remains unresolved and the topic is reloaded. Updating namespace policies temporarily restores enforcement until the topic reloads again. Fixed versions change this behavior to fail topic loading on initialization errors, preventing the encryption requirement from being disabled silently. Affected versions are Apache Pulsar >=1.22.0-incubating <4.0.14 and >=4.1.0 <4.2.5.

Authenticated clients with permission to produce messages to affected topics can publish unencrypted messages despite the namespace policy requiring encryption. This weakens the intended security controls by allowing unencrypted data storage and transmission on topics that should enforce encryption. However, the vulnerability does not expose the content of already encrypted messages or encryption keys. The issue can persist across topic reloads, broker restarts, or namespace bundle reassignments if the initialization failure is not resolved.

A fix is available in Apache Pulsar versions 4.0.14 and 4.2.5 and later, which cause topic loading to fail on initialization errors instead of disabling encryption enforcement. Users should upgrade to these fixed versions or newer. For users unable to upgrade immediately, monitor broker logs for warnings indicating that encryption enforcement has been disabled (e.g., messages containing "isEncryptionRequired will be set to false"), resolve the underlying initialization failure, and reload the affected topic to restore enforcement. Enforcement is reliably restored only after the root cause is fixed and the topic is reloaded.