CVE-2026-105938: CWE-863 Incorrect Authorization in Apache Software Foundation Apache Pulsar

Apache Pulsar namespaces can restrict subscription usage by roles through Prefix subscription authentication mode or explicit subscription permissions. However, several admin REST API operations—namespace-level and bundle-level clear backlog, unsubscribe operations, and topic-level expire messages for all subscriptions—did not enforce these subscription policies. With the default authorization provider, users with consume permission on the namespace or topic could bypass restrictions and perform these operations on subscriptions they should not access, without needing tenant admin or superuser privileges. This affects the integrity of subscription state by advancing cursors or deleting subscriptions, potentially causing unacknowledged messages to be skipped or deleted. The vulnerability does not allow reading message contents, changing permissions, or impacting broker availability. Fixed versions apply subscription policies correctly to these operations and restrict geo-replication backlog clearing to tenant admins or superusers. The issue affects Apache Pulsar versions >=2.8.0 <4.0.14 and >=4.1.0 <4.2.5. Users should upgrade to >=4.0.14 for 4.0.x versions and >=4.2.5 for 4.1.x and 4.2.x versions. All brokers in a cluster must be upgraded to ensure consistent enforcement.

The vulnerability allows an authenticated user with consume permission on a namespace or topic to bypass subscription-level authorization policies for certain admin REST API operations. This can lead to unauthorized clearing of subscription backlogs, expiring messages, or deleting subscriptions, thereby compromising the integrity of subscription state. Unacknowledged messages may be skipped or permanently deleted if no other subscription or retention policy retains them. The vulnerability does not permit reading message contents, modifying permissions or policies, accessing other namespaces, or disrupting broker availability.

A fix is available in Apache Pulsar versions 4.0.14 and later for the 4.0.x line, and 4.2.5 and later for the 4.1.x and 4.2.x lines. Users should upgrade to these versions or newer to remediate the issue. All brokers in a cluster must be upgraded to ensure consistent enforcement of subscription policies. For users unable to upgrade immediately, exposure can be reduced by restricting network access to the broker's admin REST API to trusted administrative clients.