CVE-2026-105869
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability in Apache Pulsar's MultiRolesTokenAuthorizationProvider allows a client to be authorized with all roles listed in an unverified JWT claim. When anonymousUserRole is set and authentication fails but falls back to anonymous, an unauthenticated client can send a forged or unsigned token with arbitrary roles and be authorized, potentially gaining super-user access.
Risk Assessment
An unauthenticated client can access broker HTTP endpoints (admin REST API, WebSocket API) with super-user privileges, enabling reading and modification of tenants, namespaces, topics, permissions, and broker configuration.
Recommendation
Upgrade Apache Pulsar to at least 4.0.14 (for 4.0.x) or 4.2.5 (for 4.1.x and 4.2.x). If immediate upgrade is not possible, remove the anonymousUserRole setting or restrict network access to the broker's HTTP and WebSocket endpoints to trusted clients.
Other vulnerabilities in Apache Pulsar
See all- CVE-2026-105945High
The Apache Pulsar Packages Management Service with the FileSystemPackagesStorageProvider did not validate the version component of a package name, which could contain URL-encoded path separators and parent directory references. This allowed the filesystem storage provider to resolve the version to a location belonging to a package in a different tenant or namespace, and the containment check inside the storage directory did not prevent the access. An authenticated user with the packages permission on any namespace could download, overwrite or delete packages in other tenants or namespaces.
- CVE-2026-105942High
Apache Pulsar contains two flaws in the authorization of requests forwarded by a proxy on behalf of another user. The first authorizes the original principal using the proxy's authentication data (affecting e.g. MultiRolesTokenAuthorizationProvider), and the second skips the original principal check for tenant admin operations when the proxy role is a tenant admin. This may allow users to perform operations beyond their own permissions.
- CVE-2026-105938Low
Apache Pulsar did not apply subscription policies (Prefix subscription authentication mode or subscription permissions) in several admin REST API operations acting on subscriptions: clearing the backlog (for a named subscription and for all subscriptions), unsubscribe, and expiring messages for all subscriptions of a topic. An authenticated user with consume permission on the namespace or topic could bypass these policies and clear the backlog, expire messages, or delete a subscription that the policies would deny to that user.
- CVE-2026-105937High
A vulnerability in Apache Pulsar affects the shadow topics mechanism (PIP-180). The broker authorizes the caller only against the topic being created or updated, not against the source topic named in the PULSAR.SHADOW_SOURCE property. This allows an authenticated user with permission to create topics or update topic properties in one tenant to bind a topic to a source topic in another tenant and read its retained messages.
- CVE-2026-105936Medium
In Apache Pulsar, the functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors) returns the IO connector catalog without requiring super-user access, whereas the worker connectors endpoint enforces this check. As a result, any authenticated client can read the connector catalog metadata regardless of its role permissions. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5.
- CVE-2026-105935Medium
The vulnerability affects the Apache Pulsar Functions Worker REST API trigger endpoint. The Worker publishes a message to the function's input topic using its own broker-client credentials rather than the caller's credentials, and does not verify that the caller is authorized to produce to that topic. Versions before 2.4.0 perform no caller authorization check for this endpoint at all.
- CVE-2026-105934High
Apache Pulsar broker versions 2.8.0 through 4.0.13 and 4.1.0 through 4.2.4 do not apply the tenant admin check to the caller for the truncate operation on a partitioned topic. Instead, the broker truncates each partition using its own internal admin client, so an authenticated user without tenant admin rights but with lookup permission can truncate any partitioned topic. This skips unacknowledged subscription backlog and permanently deletes older ledgers regardless of the namespace retention policy.
- CVE-2026-105933Low
Apache Pulsar allows administrators to enforce end-to-end message encryption for all topics in a namespace via the encryption_required namespace policy. If loading a persistent topic fails during initialization (e.g., metadata store read error or topic-level policy load failure), the broker logs a warning, disables the encryption requirement for that topic, and completes the topic load as successful. As a result, an authenticated client with produce permissions can publish unencrypted messages that the broker accepts and stores, even though the namespace policy requires encryption.
- CVE-2026-105932Low
The Apache Pulsar broker admin REST API endpoints for non-persistent topics (/admin/v2/non-persistent/.../entryFilters) do not perform the entry filters topic policy authorization check, unlike persistent topic endpoints. An authenticated user with produce or consume permission on a non-persistent topic can read, replace, or remove that topic's entry filter policy. This affects versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5.
- CVE-2026-105931Low
The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator, without checking whether the caller is permitted to access the tenant, namespace or topic whose data is returned. As a result, any authenticated user, including one with no permissions, can read transaction coordinator and transaction information belonging to other tenants.
Original NVD description (English source)
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed the token's claims with the signature removed and trusted that authentication had already checked it. When authentication and authorization are enabled with a non-empty anonymousUserRole setting, some HTTP requests whose credentials fail authentication are not rejected, but are handled as requests of the anonymous user role. For the broker's HTTP endpoints, such as the admin REST API, this fallback applies to requests that do not name an authentication method and requires strictAuthMethod to be false (the default) where that setting is available. For the WebSocket API, failed credentials can also fall back to the anonymous user role; this path does not enforce strictAuthMethod. The authentication data kept for such a request still contained the request's Authorization header. MultiRolesTokenAuthorizationProvider then read the bearer token from that header without verifying its signature and authorized the request with the roles in the token's role claim. As a result, in deployments that use MultiRolesTokenAuthorizationProvider together with a non-empty anonymousUserRole and that permit this fallback, an unauthenticated client can send an HTTP request, for example to the admin REST API or the WebSocket API, with a forged or unsigned token that lists arbitrary roles, and be authorized with those roles. The impact can include super-user access when the token lists a role configured in superUserRoles, allowing the client to read and change tenants, namespaces, topics, permissions and broker configuration. No valid credentials are required. Deployments are not affected if they use the default authorization provider (PulsarAuthorizationProvider) or another authorization provider, or if anonymousUserRole is not set (the default). Requests that authenticate successfully with a valid token are not affected, because the token that MultiRolesTokenAuthorizationProvider reads is the token that authentication verified. Connections that use the Pulsar binary protocol are not affected by this issue, because the broker does not keep client authentication data for connections that it assigns to the anonymous user role. In fixed versions, MultiRolesTokenAuthorizationProvider obtains roles only from tokens that the configured token authentication provider has verified, using its configured keys and validation settings. Broker HTTP requests that are assigned to the anonymous user role are authorized only as that role, and invalid tokens cannot supply additional roles to WebSocket requests. The broker fails to start if MultiRolesTokenAuthorizationProvider is configured with authorization enabled but without a token authentication provider. This issue affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. Users who cannot upgrade immediately can remove the anonymousUserRole setting from the broker and WebSocket service configurations, or restrict network access to the HTTP endpoints of these services to trusted clients.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS