Improper Access Control in Apache Pulsar's Subscription Management Features
CVE-2026-105938

2.3LOW

Key Information:

Vendor

Apache
Status
Apache Pulsar
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105938?

In Apache Pulsar, improper access control allows authenticated users with basic consume permissions to perform administrative subscription operations without the necessary role-based restrictions. This includes actions like clearing message backlogs, deleting subscriptions, and expiring messages within the topic. The vulnerability arises when default authorization settings are applied, leading to potential integrity issues and unauthorized manipulation of subscription states. Users of affected versions are advised to upgrade to better secure their systems.

Affected Version(s)

Apache Pulsar 2.8.0 < 4.0.14

Apache Pulsar 4.1.0 < 4.2.5

References

https://pulsar.apache.org/security/CVE-2026-105938/
vendor-advisory
https://lists.apache.org/thread.html/zhc6wjydybdd1msnlcxm...
vendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Omar Mousa
.