CVE-2026-105935: CWE-862 Missing Authorization in Apache Software Foundation Apache Pulsar

The Pulsar Functions Worker exposes a REST API endpoint to trigger functions that publish messages to configured input topics using the Worker's broker-client credentials. In affected versions, the trigger endpoint only verifies that the caller is authorized to manage functions in the namespace but does not verify produce permissions on the input topic. This allows an authenticated user with function management rights to cause the Functions Worker to publish messages to topics they cannot produce to, including topics in other tenants, under the Worker's identity. The issue exists in Apache Pulsar versions >=2.0.0-rc1-incubating and <4.0.14, and >=4.1.0 and <4.2.5. The fix requires that callers be authorized to produce to the input topic before triggering the function. The vulnerability affects data integrity but does not impact function code security or require running function instances.

An authenticated user authorized to manage functions in a namespace can publish messages with arbitrary content to topics they are not authorized to produce to, potentially across tenants. These messages are published under the Functions Worker's identity, which must have produce permissions on the target topic. This compromises the integrity of data in affected topics, as consumers may receive unauthorized messages. The vulnerability does not affect confidentiality or availability and does not require function code execution.

Fixed versions are available: upgrade Apache Pulsar to at least 4.0.14 for the 4.0.x line or at least 4.2.5 for the 4.1.x and 4.2.x lines. For versions prior to 2.4.0, restrict access to the Functions Worker REST API to trusted callers. For versions 2.4.0 and later with authorization enabled but not yet upgraded, limit the permission to manage functions to trusted roles. These mitigations reduce the risk until upgrading to a fixed version.