Authorization Bypass Vulnerability in Apache Pulsar Broker Admin API
CVE-2026-105932

2.3LOW

Key Information:

Vendor

Apache
Status
Apache Pulsar
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105932?

The Apache Pulsar broker admin REST API contains a vulnerability where non-persistent topics lack proper authorization checks for entry filter policy operations. Authenticated users with produce or consume permissions on a non-persistent topic may remove or alter the topic's entry filter policies, which should be restricted to users with higher privileges. This issue arises when specific broker configurations are met regarding entry filters, potentially allowing unauthorized users to affect message delivery. Users are advised to upgrade to patched versions and maintain default security settings to mitigate risks from this vulnerability.

Affected Version(s)

Apache Pulsar 3.3.0 < 4.0.14

Apache Pulsar 4.1.0 < 4.2.5

References

https://pulsar.apache.org/security/CVE-2026-105932/
vendor-advisory
https://lists.apache.org/thread.html/y30v2pv2gyj3kn4p1xxm...
vendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

yangxi739
n0mi1k
Mingsheng Lin of Institute of Information Engineering, CAS
Xingchen Chen of Institute of Information Engineering, CAS
Qixu Liu of Institute of Information Engineering, CAS
sec-reex
.