WebSocket Service Vulnerability in Apache Pulsar Affects Message Injection
CVE-2026-105927

2.3LOW

Key Information:

Vendor

Apache
Status
Apache Pulsar
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105927?

The Apache Pulsar WebSocket service has a vulnerability that allows authenticated users with only CONSUME permission to inject messages into any topic they choose, including those owned by other tenants. This occurs because, while the service verifies permissions for consuming messages, it fails to check the produce permissions on the target deadLetterTopic. This can lead to an unauthorized injection of messages into restricted topics, impacting storage and causing potential processing issues in applications. To mitigate this risk, users are advised to upgrade to the latest versions or disable the WebSocket service if not in use. Proper configuration and role management are essential to reduce exposure.

Affected Version(s)

Apache Pulsar 2.3.0 < 4.0.14

Apache Pulsar 4.1.0 < 4.2.5

References

https://pulsar.apache.org/security/CVE-2026-105927/
vendor-advisory
https://lists.apache.org/thread.html/1577zmjsxssb9zkg34sj...
vendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

MopMonk-AI
tim
.