Unauthorized Truncation Vulnerability in Apache Pulsar Broker Admin REST API
CVE-2026-105934

7.2HIGH

Key Information:

Vendor

Apache
Status
Apache Pulsar
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105934?

A critical vulnerability in the Apache Pulsar broker admin REST API allows users without tenant admin roles to truncate partitioned topics. The truncate operation resets subscription cursors and deletes inactive ledgers, potentially resulting in message loss. The issue occurs because the broker uses its internal identity for authorization checks instead of the caller's identity, allowing unauthorized users to perform sensitive operations as long as they have lookup permissions. This vulnerability affects versions of Apache Pulsar from 2.8.0 up to 4.0.14 and from 4.1.0 up to 4.2.5, requiring users to upgrade their installations to maintain security.

Affected Version(s)

Apache Pulsar 2.8.0 < 4.0.14

Apache Pulsar 4.1.0 < 4.2.5

References

https://pulsar.apache.org/security/CVE-2026-105934/
vendor-advisory
https://lists.apache.org/thread.html/ox0vy41jlb41y2l04y7b...
vendor-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingsheng Lin of Institute of Information Engineering, CAS
Xingchen Chen of Institute of Information Engineering, CAS
Qixu Liu of Institute of Information Engineering, CAS
.