CVE-2026-105934: CWE-862 Missing Authorization in Apache Software Foundation Apache Pulsar

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics. For partitioned topics, the broker does not apply tenant admin authorization checks to the caller but instead uses its internal admin client credentials to perform per-partition truncation. If the broker's internal identity has superuser or tenant admin rights, an authenticated user with only lookup permission can truncate any partitioned topic. This truncation moves all subscription cursors to the end, skipping unacknowledged backlog, and deletes eligible older ledgers, potentially causing permanent message loss. The vulnerability does not allow reading message contents, changing permissions, or accessing topics without lookup permission. Affected versions are Apache Pulsar >=2.8.0 <4.0.14 and >=4.1.0 <4.2.5. Patches are available in 4.0.14 and 4.2.5. The issue is tracked as CWE-862 (Missing Authorization).

An authenticated user with lookup permission but without tenant admin rights can truncate partitioned topics, causing subscription cursors to skip unacknowledged messages and deleting older ledgers regardless of retention policy. This results in potential permanent loss of messages. The vulnerability does not allow unauthorized reading of message contents or modification of permissions or configurations. The impact depends on the broker's internal admin client having superuser or tenant admin rights, which is typical in default authorization configurations.

A fix is available in Apache Pulsar versions 4.0.14 and 4.2.5. Users should upgrade to at least these versions or newer. For users unable to upgrade immediately, exposure can be reduced by restricting network access to the broker's admin REST API (/admin/v2) to trusted administrative clients only.