Authorization Flaw in Apache Pulsar Affects Multiple Versions

CVE-2026-105942

What is CVE-2026-105942?

A security vulnerability in Apache Pulsar allows a configured proxy role to authorize requests on behalf of the original user using incorrect authentication data. This can lead to unauthorized access to tenant administration operations and potentially compromise system integrity. In affected versions, if a proxy role is incorrectly set as a tenant admin or utilizes certain authorization providers, users can gain permissions exceeding their actual roles. To mitigate this risk, users should upgrade to the latest patched versions immediately.

References