CVE-2026-105937: CWE-862 Missing Authorization in Apache Software Foundation Apache Pulsar

Apache Pulsar's shadow topics feature allows topics to read stored messages from a source topic via the PULSAR.SHADOW_SOURCE property. The vulnerability arises because the broker authorizes topic creation or update requests only against the topic being created or updated, not against the source topic named in the shadow source property. Consequently, an authenticated user with tenant admin permissions on their own tenant can create or update shadow topics bound to source topics in other tenants without needing permissions on those source topics. This enables unauthorized consumption of retained messages from other tenants' topics and registration of new schema versions under the source topic's schema. Furthermore, shadow topics apply their own retention and deletion policies to the source topic's ledgers, potentially causing permanent data loss including unacknowledged messages. The vulnerability affects Apache Pulsar versions >=3.0.0 <4.0.14 and >=4.1.0 <4.2.5. Fixed versions disable shadow topics by default, require superuser role for cross-tenant shadow topic binding, and prevent shadow topics from deleting or trimming source topic ledgers.

An authenticated user with tenant admin role in their own tenant can bypass authorization on source topics in other tenants by creating or updating shadow topics bound to those source topics. This leads to unauthorized access to retained messages in the source topic's ledger, although client-side encrypted messages remain protected. The user can also register new schema versions under the source topic's schema. Critically, shadow topics can cause permanent deletion of source topic ledger data, including unacknowledged messages, resulting in data loss. This data loss risk extends even to intentionally configured shadow topics. The vulnerability compromises confidentiality and integrity of data across tenants and risks availability of source topic data.

Fixed versions of Apache Pulsar (>=4.0.14 for 4.0.x and >=4.2.5 for 4.1.x and 4.2.x) disable shadow topics by default and require the superuser role to bind shadow topics to source topics in different tenants. They also prevent shadow topics from deleting or trimming source topic ledgers. Users should upgrade to these fixed versions or newer. After upgrading, deployments using shadow topics must enable them explicitly by setting enableShadowTopics=true in broker configuration. For users unable to upgrade immediately, limiting the tenant admin role to trusted principals can reduce exposure. No configuration option exists to disable shadow topics in affected versions, so upgrading is the recommended remediation.