CVE-2026-105937
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability in Apache Pulsar affects the shadow topics mechanism (PIP-180). The broker authorizes the caller only against the topic being created or updated, not against the source topic named in the PULSAR.SHADOW_SOURCE property. This allows an authenticated user with permission to create topics or update topic properties in one tenant to bind a topic to a source topic in another tenant and read its retained messages.
Risk Assessment
A user can access messages from a topic in another tenant without permissions on it and can permanently delete the source topic's ledger data from BookKeeper and tiered storage, regardless of the source topic's retention policy and subscriptions. The risk includes data exposure and loss of unacknowledged messages.
Recommendation
Upgrade Apache Pulsar to at least 4.0.14 (for 4.0.x) or 4.2.5 (for 4.1.x and 4.2.x). If immediate upgrade is not possible, restrict the tenant admin role to trusted principals only.
Other vulnerabilities in Apache Pulsar
See all- CVE-2026-105869Critical
A vulnerability in Apache Pulsar's MultiRolesTokenAuthorizationProvider allows a client to be authorized with all roles listed in an unverified JWT claim. When anonymousUserRole is set and authentication fails but falls back to anonymous, an unauthenticated client can send a forged or unsigned token with arbitrary roles and be authorized, potentially gaining super-user access.
- CVE-2026-105945High
The Apache Pulsar Packages Management Service with the FileSystemPackagesStorageProvider did not validate the version component of a package name, which could contain URL-encoded path separators and parent directory references. This allowed the filesystem storage provider to resolve the version to a location belonging to a package in a different tenant or namespace, and the containment check inside the storage directory did not prevent the access. An authenticated user with the packages permission on any namespace could download, overwrite or delete packages in other tenants or namespaces.
- CVE-2026-105942High
Apache Pulsar contains two flaws in the authorization of requests forwarded by a proxy on behalf of another user. The first authorizes the original principal using the proxy's authentication data (affecting e.g. MultiRolesTokenAuthorizationProvider), and the second skips the original principal check for tenant admin operations when the proxy role is a tenant admin. This may allow users to perform operations beyond their own permissions.
- CVE-2026-105938Low
Apache Pulsar did not apply subscription policies (Prefix subscription authentication mode or subscription permissions) in several admin REST API operations acting on subscriptions: clearing the backlog (for a named subscription and for all subscriptions), unsubscribe, and expiring messages for all subscriptions of a topic. An authenticated user with consume permission on the namespace or topic could bypass these policies and clear the backlog, expire messages, or delete a subscription that the policies would deny to that user.
- CVE-2026-105936Medium
In Apache Pulsar, the functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors) returns the IO connector catalog without requiring super-user access, whereas the worker connectors endpoint enforces this check. As a result, any authenticated client can read the connector catalog metadata regardless of its role permissions. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5.
- CVE-2026-105935Medium
The vulnerability affects the Apache Pulsar Functions Worker REST API trigger endpoint. The Worker publishes a message to the function's input topic using its own broker-client credentials rather than the caller's credentials, and does not verify that the caller is authorized to produce to that topic. Versions before 2.4.0 perform no caller authorization check for this endpoint at all.
- CVE-2026-105934High
Apache Pulsar broker versions 2.8.0 through 4.0.13 and 4.1.0 through 4.2.4 do not apply the tenant admin check to the caller for the truncate operation on a partitioned topic. Instead, the broker truncates each partition using its own internal admin client, so an authenticated user without tenant admin rights but with lookup permission can truncate any partitioned topic. This skips unacknowledged subscription backlog and permanently deletes older ledgers regardless of the namespace retention policy.
- CVE-2026-105933Low
Apache Pulsar allows administrators to enforce end-to-end message encryption for all topics in a namespace via the encryption_required namespace policy. If loading a persistent topic fails during initialization (e.g., metadata store read error or topic-level policy load failure), the broker logs a warning, disables the encryption requirement for that topic, and completes the topic load as successful. As a result, an authenticated client with produce permissions can publish unencrypted messages that the broker accepts and stores, even though the namespace policy requires encryption.
- CVE-2026-105932Low
The Apache Pulsar broker admin REST API endpoints for non-persistent topics (/admin/v2/non-persistent/.../entryFilters) do not perform the entry filters topic policy authorization check, unlike persistent topic endpoints. An authenticated user with produce or consume permission on a non-persistent topic can read, replace, or remove that topic's entry filter policy. This affects versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5.
- CVE-2026-105931Low
The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator, without checking whether the caller is permitted to access the tenant, namespace or topic whose data is returned. As a result, any authenticated user, including one with no permissions, can read transaction coordinator and transaction information belonging to other tenants.
Original NVD description (English source)
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of an existing topic. On these paths the broker authorizes the caller only against the topic being created or updated. It does not authorize the caller against the source topic named in the property. The existing authorization for shadow topic configuration (the SHADOW_TOPIC topic policy on the source topic) is applied only to the source-side shadow topics admin API, not to these paths. As a result, an authenticated user who is allowed to create topics or update topic properties in one tenant can bind a topic in that tenant to a persistent topic in any other tenant. With the default authorization provider, these operations require the tenant admin role for the user's own tenant. The user does not need any permission on the source topic, its namespace or its tenant. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different. The user can then consume from the shadow topic, using only permissions on their own topic, and receive retained messages that were published to the source topic in the other tenant. Exposure is limited to messages that are still retained and readable in the source topic's ledgers; messages protected with client-side end-to-end encryption cannot be decrypted without the encryption keys. A producer on the shadow topic can also register a new schema version under the source topic's schema, subject to the schema compatibility settings; existing schema versions are not replaced. In addition, the shadow topic's managed ledger applies its own retention, trimming, offloading and deletion to the source topic's ledgers. This can permanently delete the source topic's ledger data from BookKeeper and from tiered storage, regardless of the source topic's own subscriptions and retention policy, including messages that have not yet been acknowledged. Deleting the shadow topic can also delete the source topic's ledgers. This data loss can also affect shadow topics that were configured intentionally by administrators. This issue affects Apache Pulsar versions from 3.0.0 before 4.0.14 and from 4.1.0 before 4.2.5. Apache Pulsar 2.x releases do not contain the shadow topic implementation. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. In the fixed versions, shadow topics are disabled by default and are controlled by the new broker configuration setting enableShadowTopics (default false). While it is disabled, the broker rejects creating shadow topics, setting the PULSAR.SHADOW_SOURCE property, and loading or replicating to existing shadow topics. Deployments that use shadow topics must set enableShadowTopics=true in the broker configuration of all brokers after upgrading; otherwise existing shadow topics will not be loaded. When shadow topics are enabled, binding a shadow topic to a source topic in a different tenant requires the superuser role. The fixed versions also prevent a shadow topic from deleting or trimming the ledgers and offloaded data of its source topic. Affected versions provide no configuration option to disable shadow topics. Users who cannot upgrade immediately can reduce exposure by granting the tenant admin role only to trusted principals.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS