Path Traversal Vulnerability in Pulsar Package Management Service by Apache
CVE-2026-105945

7.7HIGH

Key Information:

Vendor

Apache
Status
Apache Pulsar
Vendor
CVE Published:
21 October 2026

What is CVE-2026-105945?

The Pulsar Packages Management Service is compromised due to improper validation of version components in package names, allowing authenticated users with the 'packages' permission to manipulate packages across different tenants and namespaces. This vulnerability enables an attacker to download, overwrite, or delete packages, potentially affecting the functionality and availability of Pulsar Functions, Sources, or Sinks. If authentication is disabled, the issue can be exploited by any client accessing the broker's admin REST API. The problem specifically impacts deployments where package management is enabled and configured with the filesystem storage provider, making it crucial for users to upgrade to patched versions.

Affected Version(s)

Apache Pulsar 2.10.0 < 4.0.14

Apache Pulsar 4.1.0 < 4.2.5

References

https://pulsar.apache.org/security/CVE-2026-105945/
vendor-advisory
https://lists.apache.org/thread.html/o5jt8zrg1qxqdrqlb06j...
vendor-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k
GSIeaves
.