Authorization Flaw in Apache Pulsar Functions Worker REST API by Apache

CVE-2026-105935

What is CVE-2026-105935?

An authorization flaw in Apache Pulsar's Functions Worker REST API allows authenticated users to publish messages to input topics for which they lack production capability. This vulnerability affects versions from 2.0.0-rc1-incubating up to 4.2.4. When a function is triggered through the REST API, the system improperly checks permissions, only verifying that the caller can manage functions within a namespace, but neglecting their ability to produce to intended input topics. In versions prior to 2.4.0, this check is entirely bypassed, leading to potential data integrity issues. This flaw could permit unauthorized message publishing, compromising the integrity of affected topics as they may receive messages from unprivileged users.

References