CVE-2026-105927
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Apache Pulsar WebSocket service allows an authenticated user holding CONSUME permission on any topic to configure a dead letter policy with an arbitrary deadLetterTopic. The service does not verify the user's PRODUCE permission on that topic and writes dead letter messages using its own broker client identity, enabling injection of messages into topics the user is not permitted to produce to, including namespaces of other tenants.
Risk Assessment
An authenticated user can inject messages into any existing topic (or a newly created one under default automatic topic creation) if the WebSocket service role is authorized to produce to that topic. This can lead to unauthorized influence over applications consuming the target topic and to consumption of storage and backlog capacity in the target namespace.
Recommendation
Upgrade Apache Pulsar to at least 4.0.14 (for 4.0.x) or 4.2.5 (for 4.1.x and 4.2.x). If immediate upgrade is not possible, disable the WebSocket service; where it is required, restrict network access to it and limit the permissions of the role the WebSocket service uses to connect to the brokers to the intended namespaces.
Other vulnerabilities in Apache Pulsar
See all- CVE-2026-105869Critical
A vulnerability in Apache Pulsar's MultiRolesTokenAuthorizationProvider allows a client to be authorized with all roles listed in an unverified JWT claim. When anonymousUserRole is set and authentication fails but falls back to anonymous, an unauthenticated client can send a forged or unsigned token with arbitrary roles and be authorized, potentially gaining super-user access.
- CVE-2026-105945High
The Apache Pulsar Packages Management Service with the FileSystemPackagesStorageProvider did not validate the version component of a package name, which could contain URL-encoded path separators and parent directory references. This allowed the filesystem storage provider to resolve the version to a location belonging to a package in a different tenant or namespace, and the containment check inside the storage directory did not prevent the access. An authenticated user with the packages permission on any namespace could download, overwrite or delete packages in other tenants or namespaces.
- CVE-2026-105942High
Apache Pulsar contains two flaws in the authorization of requests forwarded by a proxy on behalf of another user. The first authorizes the original principal using the proxy's authentication data (affecting e.g. MultiRolesTokenAuthorizationProvider), and the second skips the original principal check for tenant admin operations when the proxy role is a tenant admin. This may allow users to perform operations beyond their own permissions.
- CVE-2026-105938Low
Apache Pulsar did not apply subscription policies (Prefix subscription authentication mode or subscription permissions) in several admin REST API operations acting on subscriptions: clearing the backlog (for a named subscription and for all subscriptions), unsubscribe, and expiring messages for all subscriptions of a topic. An authenticated user with consume permission on the namespace or topic could bypass these policies and clear the backlog, expire messages, or delete a subscription that the policies would deny to that user.
- CVE-2026-105937High
A vulnerability in Apache Pulsar affects the shadow topics mechanism (PIP-180). The broker authorizes the caller only against the topic being created or updated, not against the source topic named in the PULSAR.SHADOW_SOURCE property. This allows an authenticated user with permission to create topics or update topic properties in one tenant to bind a topic to a source topic in another tenant and read its retained messages.
- CVE-2026-105936Medium
In Apache Pulsar, the functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors) returns the IO connector catalog without requiring super-user access, whereas the worker connectors endpoint enforces this check. As a result, any authenticated client can read the connector catalog metadata regardless of its role permissions. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5.
- CVE-2026-105935Medium
The vulnerability affects the Apache Pulsar Functions Worker REST API trigger endpoint. The Worker publishes a message to the function's input topic using its own broker-client credentials rather than the caller's credentials, and does not verify that the caller is authorized to produce to that topic. Versions before 2.4.0 perform no caller authorization check for this endpoint at all.
- CVE-2026-105934High
Apache Pulsar broker versions 2.8.0 through 4.0.13 and 4.1.0 through 4.2.4 do not apply the tenant admin check to the caller for the truncate operation on a partitioned topic. Instead, the broker truncates each partition using its own internal admin client, so an authenticated user without tenant admin rights but with lookup permission can truncate any partitioned topic. This skips unacknowledged subscription backlog and permanently deletes older ledgers regardless of the namespace retention policy.
- CVE-2026-105933Low
Apache Pulsar allows administrators to enforce end-to-end message encryption for all topics in a namespace via the encryption_required namespace policy. If loading a persistent topic fails during initialization (e.g., metadata store read error or topic-level policy load failure), the broker logs a warning, disables the encryption requirement for that topic, and completes the topic load as successful. As a result, an authenticated client with produce permissions can publish unencrypted messages that the broker accepts and stores, even though the namespace policy requires encryption.
- CVE-2026-105932Low
The Apache Pulsar broker admin REST API endpoints for non-persistent topics (/admin/v2/non-persistent/.../entryFilters) do not perform the entry filters topic policy authorization check, unlike persistent topic endpoints. An authenticated user with produce or consume permission on a non-persistent topic can read, replace, or remove that topic's entry filter policy. This affects versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5.
Original NVD description (English source)
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. When authorization is enabled, the WebSocket service checks only that the connecting user holds the CONSUME permission on the subscribed topic. It does not check whether the user holds the PRODUCE permission on the topic named in deadLetterTopic. The dead letter messages are then written by the WebSocket service using its own broker client identity rather than the identity of the connecting user. As a result, an authenticated user who holds the CONSUME permission on at least one topic can cause messages to be written to a topic of their choosing in any existing namespace, including namespaces belonging to other tenants, provided the role used by the WebSocket service to connect to the brokers is authorized to produce to that topic and the topic accepts a producer that registers no schema. The dead letter producer created by the WebSocket service registers no schema, so it is rejected when the target topic has a schema and schema validation is enforced for that topic or its namespace; this setting is not enabled by default. The same user is refused when attempting to produce to that topic directly. Where automatic topic creation is enabled, which is the default, the named topic is created if it does not already exist. The issue can only be triggered when the WebSocket service is enabled, either in the broker (webSocketServiceEnabled, which is disabled by default) or as a standalone WebSocket proxy. The impact is unauthorized injection of messages into topics the user is not permitted to produce to. The user can determine the content of the injected messages when they also control the messages on the subscribed topic. The issue does not allow reading, modifying or deleting existing messages in the target topic. Injected messages carry the dead letter message properties and a dead letter producer name, so they can be distinguished from messages produced normally; however, the values of these properties are not authenticated and should not be relied upon to establish the origin of a message. Whether an injected message has further consequences depends on how the applications consuming the target topic process it. Repeated injection also consumes storage and backlog capacity in the target namespace. This issue affects Apache Pulsar versions from 2.3.0 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. Users who cannot upgrade immediately and do not require the WebSocket service should disable it. Where the WebSocket service is required, restricting network access to it and limiting the permissions granted to the role the WebSocket service uses to connect to the brokers to the namespaces WebSocket clients are intended to access reduces the exposure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS