Threat Intelligence Database

CVE-2026-105945 is a path traversal vulnerability in Apache Pulsar's Packages Management Service when using the filesystem storage provider. It allows an authenticated user with package permissions on any namespace to access, overwrite, or delete packages in other tenants or namespaces by exploiting improper validation of the version component in package names. This can impact the integrity and availability of Pulsar Functions, Sources, or Sinks that rely on these packages. The vulnerability affects deployments with package management enabled and configured to use the filesystem storage provider. It impacts Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5. Package management is disabled by default, and the default storage provider (Apache BookKeeper) is not affected.

CVE-2026-105942 is a high-severity authorization vulnerability in Apache Pulsar affecting versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5. It involves incorrect authorization checks when a proxy role sends requests on behalf of another user, allowing the original principal to be authorized with the proxy's authentication data or bypass tenant admin checks if the proxy role is a tenant admin. This can lead to unauthorized operations if the proxy role has elevated permissions. Fixed versions enforce correct authorization for both proxy role and original principal using their respective credentials.

CVE-2026-105938 is an authorization bypass vulnerability in Apache Pulsar affecting subscription-related admin REST API operations. It allows authenticated users with consume permission on a namespace or topic to clear backlog, expire messages, or delete subscriptions that they are not authorized to manage under certain subscription policies. The issue impacts subscription state integrity by moving cursors forward or deleting subscriptions, but does not expose message contents or affect broker availability. The vulnerability affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions enforce subscription policies on these operations and restrict geo-replication cursor backlog clearing to tenant admins or superusers.

Apache Pulsar versions from 3.0.0 before 4.0.14 and from 4.1.0 before 4.2.5 contain a missing authorization vulnerability in the handling of shadow topics. An authenticated user with tenant admin role in their own tenant can create or update shadow topics bound to source topics in other tenants without authorization on those source topics. This allows unauthorized reading of retained messages and potential schema modifications. Additionally, shadow topics can cause permanent deletion of source topic ledger data, leading to data loss. Fixed versions disable shadow topics by default and require superuser role for cross-tenant shadow topic binding, preventing unauthorized access and ledger deletion.

CVE-2026-105936 is a missing authorization vulnerability in Apache Pulsar's Functions worker REST API. It allows any authenticated user to access the catalog of Pulsar IO connectors via deprecated endpoints without requiring super-user privileges. The disclosed information is limited to connector metadata such as names and descriptions, without exposing configuration values or credentials. The issue affects versions from 2.4.1 up to but excluding 4.0.14 and from 4.1.0 up to but excluding 4.2.5. Fixed versions enforce super-user access on these endpoints.

CVE-2026-105935 is a missing authorization vulnerability in Apache Pulsar's Functions Worker REST API. Authenticated users authorized to manage functions in a namespace can trigger the Functions Worker to publish messages to input topics they are not authorized to produce to, potentially across tenants. This affects Apache Pulsar versions from 2.0.0-rc1-incubating before 4.0.14 and from 4.1.0 before 4.2.5. The vulnerability impacts data integrity by allowing unauthorized message publication under the Functions Worker's identity. Fixed versions enforce authorization checks for producing to input topics when triggering functions.

CVE-2026-105934 is a missing authorization vulnerability in Apache Pulsar's broker admin REST API truncate operation for partitioned topics. Authenticated users with lookup permission but without tenant admin rights can truncate partitioned topics, causing subscription cursors to move to the end and deletion of older ledgers, potentially leading to message loss. The vulnerability affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. Patches are available in versions 4.0.14 and 4.2.5. Users unable to upgrade immediately should restrict network access to the admin REST API.

Apache Pulsar versions from 1.22.0-incubating before 4.0.14 and from 4.1.0 before 4.2.5 have a vulnerability where the broker may disable the encryption_required policy for a topic if topic initialization fails. This failure causes the broker to accept unencrypted messages on topics that should require encryption, potentially violating security policies. The issue occurs when errors happen during topic initialization, such as failures reading metadata or topic-level policies. The broker logs a warning but completes the topic load with encryption enforcement disabled. The vulnerability does not expose encrypted message content or keys. Fixed versions cause topic load to fail on initialization errors, preventing this insecure state.

CVE-2026-105932 is a low-severity authorization vulnerability in Apache Pulsar affecting non-persistent topic entry filter policy REST API endpoints. These endpoints do not properly enforce authorization checks, allowing authenticated users with produce or consume permissions on a non-persistent topic or its namespace to read, replace, or remove the topic-level entry filter policy without having tenant admin or superuser roles. The impact is limited by default broker configurations requiring entry filters to be pre-installed and topic-level entry filter policy override to be enabled. Persistent topics and namespace-level policies are not affected. The vulnerability affects Apache Pulsar versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5. Patches are available in versions 4.0.14 and 4.2.5.

Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5 have a missing authorization vulnerability in the transaction administration REST API. Authenticated users without permissions can read transaction metadata and statistics across tenant boundaries when transaction support is enabled. The vulnerability does not allow modification of transactions or access to message contents. Transaction support is disabled by default, limiting exposure if not used.