Authorization Bypass in Apache Pulsar for Token Authentication

CVE-2026-105869

What is CVE-2026-105869?

A flaw in the MultiRolesTokenAuthorizationProvider of Apache Pulsar enables clients to exploit unauthenticated requests by manipulating JWT claims. The provider fails to validate JWT signatures, thus improperly granting roles listed in the token claim, including unauthorized super-user access. This vulnerability is particularly dangerous for deployments utilizing a non-empty anonymousUserRole combined with weakened authentication checks. It compromises sensitive operations, particularly on broker HTTP endpoints and WebSocket API requests. Versions prior to 4.0.14 and 4.2.5 are affected, with critical security implications for misconfigured settings.

References