End-to-End Message Encryption Flaw in Apache Pulsar by Apache Software Foundation

CVE-2026-105933

What is CVE-2026-105933?

Apache Pulsar has a vulnerability where end-to-end message encryption may not be enforced as intended due to initialization failures during the topic loading process. Specifically, if an error occurs when reading from the metadata store or loading topic-level policies, the broker logs a warning, disables the encryption requirement for that topic, and treats the topic load as successful. This results in an authenticated client being able to publish unencrypted messages to the topic, despite the namespace policy mandating encryption. The issue can persist across broker restarts or topic unloads until the underlying problem is resolved, requiring users to monitor broker logs for related warnings and ensuring proper enforcement of encryption by reloading the affected topics.

References