Authorization Issues in Apache Pulsar Package Management Feature

CVE-2026-105930

What is CVE-2026-105930?

This vulnerability affects Apache Pulsar's package management feature, where authentication and authorization are enabled. When users register or update Pulsar Functions, Sources, and Sinks, they can supply a package URL that the system retrieves using the worker's credentials, rather than verifying the user's permissions on the package's namespace. This flaw allows authenticated users to potentially access package contents from other tenants, which may include sensitive data such as application code or embedded credentials. Although it does not permit modifications or deletions and does not impact service availability, it poses a significant risk to data confidentiality.

References