Access Control Issue in Apache Pulsar Broker Affects Schema Commands
CVE-2026-105926

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Pulsar
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105926?

The Apache Pulsar broker exhibits an access control flaw affecting the GetSchema and GetOrCreateSchema commands. An authenticated client, lacking permissions for the target topic, can exploit this vulnerability to read schema definitions or register a schema version across namespaces or tenants. While this does not expose message payloads, the introduced schema changes can lead to compatibility issues for legitimate producers and consumers. Fixed versions enforce proper permissions, preventing unauthorized schema modifications and ensuring system integrity.

Affected Version(s)

Apache Pulsar 2.2.0 < 4.0.14

Apache Pulsar 4.1.0 <= 4.1.3

Apache Pulsar 4.2.0 < 4.2.5

References

https://pulsar.apache.org/security/CVE-2026-105926/
vendor-advisory
https://lists.apache.org/thread.html/45y22fqoqyfpc2hdmoct...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude and Ada Logics
n0mi1k
MopMonk-AI
.