CVE-2026-105936: CWE-862 Missing Authorization in Apache Software Foundation Apache Pulsar

Apache Pulsar's Functions worker REST API exposes two endpoints that return the catalog of installed Pulsar IO connectors. While the current worker connectors endpoint requires super-user access when authorization is enabled, the deprecated functions connectors endpoints do not enforce this check. Consequently, any authenticated client can retrieve connector metadata through these deprecated endpoints regardless of their permissions. The disclosed catalog includes connector names, descriptions, and class names but excludes any configured instances, sensitive configuration values, or credentials. The vulnerability is addressed by requiring super-user access on the functions connectors endpoint in fixed versions.

The vulnerability allows disclosure of connector metadata to any authenticated user without super-user privileges. This information leak is limited to connector type definitions and does not expose sensitive configuration or credentials. There is no ability to modify or manage connectors via this flaw. The impact is therefore limited to information disclosure of installed connector types, which may aid an attacker in reconnaissance but does not directly compromise system integrity or confidentiality of sensitive data.

A fix is available in Apache Pulsar versions 4.0.14 and 4.2.5 and later. Users should upgrade to at least 4.0.14 if using the 4.0.x line, or to at least 4.2.5 if using the 4.1.x or 4.2.x lines. The fix enforces super-user access checks on the deprecated functions connectors endpoints. Until upgraded, users should be aware that any authenticated client can access connector metadata via these endpoints. No additional mitigation is indicated by the vendor advisory.