Transaction Administration API Vulnerability in Apache Pulsar by Apache
CVE-2026-105931

2.3LOW

Key Information:

Vendor

Apache
Status
Apache Pulsar
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105931?

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions, which, when authentication and authorization are enabled, fails to properly validate if an authenticated user is allowed to access specific tenant, namespace, or topic data. This vulnerability allows unauthorized exposure of transaction coordinator information, including transaction metadata and statistics, to any authenticated user, even those with no explicit permissions. Although endpoints that modify transaction states are not affected, the ability to read sensitive transaction data across tenant boundaries poses significant privacy concerns for users. Users are advised to update to patched versions if they are using affected releases or disable transaction support to mitigate risks.

Affected Version(s)

Apache Pulsar 2.8.0 < 4.0.14

Apache Pulsar 4.1.0 < 4.2.5

References

https://pulsar.apache.org/security/CVE-2026-105931/
vendor-advisory
https://lists.apache.org/thread.html/82g78kf9q7gmf9m8fvsr...
vendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k
Mingsheng Lin of Institute of Information Engineering, CAS
Xingchen Chen of Institute of Information Engineering, CAS
Qixu Liu of Institute of Information Engineering, CAS
MopMonk-AI
Wanxin Yin
.