User Account Vulnerabilities in Apache Pulsar Manager by Apache Software Foundation

CVE-2026-105944

What is CVE-2026-105944?

Apache Pulsar Manager, the web console for managing Apache Pulsar clusters, has significant security vulnerabilities that allow unauthorized users to create administrator accounts and execute privileged requests. The initial admin account can be created without authentication, enabling anyone with network access to gain full control. Moreover, Pulsar Manager can proxy requests to the Pulsar admin API without adequate authentication checks, making it possible for malicious users to issue commands with sensitive credentials. As the product is unsupported, users are highly advised to cease its use and migrate to approved alternatives.

References