EUVD-2026-107426
GHSA-5q6x-rgx4-rwcr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as user with CONSUME on any topic
-
ExploitConnect to WebSocket consumer endpoint setting deadLetterTopic parameter
-
ExecutionExhaust redeliveries to trigger dead-letter write
-
ImpactInject attacker-controlled messages into cross-tenant topic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires all of: the WebSocket service is enabled (webSocketServiceEnabled in the broker, disabled by default, or a standalone WebSocket proxy); the attacker is an authenticated user holding CONSUME permission on at least one topic; the role the WebSocket service uses to connect to brokers is authorized to PRODUCE to the chosen target topic; and the target topic accepts a schema-less producer (i.e. schema validation is NOT enforced for the topic or namespace - this enforcement is not enabled by default). Automatic topic creation (enabled by default) lets a non-existent target topic be created on demand. Limiting factors that reduce real-world exposure: the WebSocket service being off by default, the authenticated-user requirement (PR:L), and the fact that enforcing schema validation on target topics fully blocks the schema-less dead-letter producer. |
| Impact | All severity signals point to a genuinely low-priority issue. The Apache-assigned CVSS 4.0 base score is 2.3 (Low): network vector (AV:N) and low complexity (AC:L), but a present attack requirement (AT:P), required privileges (PR:L, i.e. an authenticated user), and only limited integrity/availability impact (VI:L/VA:L) with no confidentiality impact. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'. The practical risk is further constrained by multiple preconditions (WebSocket service enabled - off by default; schema validation disabled on the target - the default but defeatable; and the WebSocket broker-client role being over-permissioned). The signals are consistent rather than conflicting: a low CVSS, no active-exploitation evidence, and a narrow impact (message injection only, no read/modify/delete) all agree this is an authorization-correctness/hardening defect, not an urgent emergency. One nuance worth verifying with the vendor: the cross-tenant impact (writing into another tenant's namespace) could arguably justify a CVSS scope change, which the vendor vector did not reflect (SC:N). |
| Exploit ScenarioDerived | An authenticated tenant user who legitimately holds CONSUME on a single topic connects to the Pulsar WebSocket consumer endpoint and sets the deadLetterTopic query parameter to a topic in another tenant's namespace. By exhausting redeliveries on messages they control, the service - acting under its own privileged broker-client identity rather than the user's - writes attacker-chosen messages into that foreign topic, which is auto-created if absent. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Apache Pulsar's WebSocket service performs an incomplete authorization check when a WebSocket consumer supplies a dead letter policy via consumer endpoint query parameters, letting an authenticated user who holds only CONSUME permission on a subscribed topic cause messages to be written into a topic of their choosing - potentially in another tenant's namespace - because the deadLetterTopic's PRODUCE permission is never verified and the write is performed with the WebSocket service's own broker client identity. Affected releases are 2.3.0 through 4.0.13 and 4.1.0 through 4.2.4; the practical exposure is limited because webSocketServiceEnabled is off by default, the attacker must be an authenticated user, the WebSocket service's broker role must already hold PRODUCE on the target, and the target must accept a schema-less producer (schema validation is not enforced by default). Impact is limited to unauthorised message injection with low integrity and availability effect (dead-letter messages are distinguishable by their properties, but those properties are unauthenticated and cannot be trusted to establish origin); no public exploit code or CISA KEV-listed active exploitation was identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Apache Pulsar 4.0.14 or later for 4.0.x deployments, and to 4.2.5 or later for 4.1.x/4.2.x deployments, per the advisory at https://pulsar.apache.org/security/CVE-2026-105927/. If an immediate upgrade is not possible and the WebSocket service is not needed, disable it (webSocketServiceEnabled=false in broker.conf, or stop/retire the standalone WebSocket proxy) - this fully removes the attack path but breaks any WebSocket-based clients. Where WebSocket access is required, restrict network reachability to the WebSocket endpoint (security group/firewall allow-lists, ingress policies) so only intended client networks can connect, accepting that this is a perimeter control that does not fix the missing authorization check. Additionally, tighten the broker role used by the WebSocket service so it holds PRODUCE only on the namespaces WebSocket clients are actually meant to reach, which shrinks the set of reachable deadLetterTopic targets at the cost of re-scoping service credentials. As a defense-in-depth control, enforce schema validation on sensitive topics and namespaces: the dead letter producer registers no schema, so it will be rejected there - but this only works for topics that legitimately have schemas, and enabling it may break existing schema-less producers. Finally, treat dead letter message properties and producer names in these injections as unauthenticated and do not use them for provenance in downstream consumers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-863 incorrect authorization issue in the Pulsar WebSocket consumer endpoint. Pulsar WebSocket consumers may configure a dead letter policy (redelivery limits plus a deadLetterTopic) through query parameters of the consumer endpoint. When authentication/authorization is enabled, the WebSocket service validates only that the connecting user holds CONSUME on the subscribed topic; it never checks PRODUCE on the topic named by deadLetterTopic. The dead letter producer is then created with the WebSocket service's own broker client identity rather than the connecting user's, so the effective privilege is that of the service role - meaning the same user would be refused if they attempted the direct produce themselves. Two implementation details broaden the reach: automatic topic creation, enabled by default, will create the named target topic if it does not exist, and the dead letter producer registers no schema, so it is only rejected when the target topic or namespace enforces schema validation (also not a default). The result is write-only cross-namespace, potentially cross-tenant message injection, with the injected messages carrying dead letter message properties and a dead letter producer name; because those values are unauthenticated, consumers must not rely on them for provenance. The WebSocket service must be enabled either in the broker (webSocketServiceEnabled, disabled by default) or run as a standalone WebSocket proxy for the path to exist at all. Note the assessed CVSS:3.1 vector uses AC:H and a low integrity/availability impact, reflecting the cumulative preconditions rather than any unauthenticated or read/write-everything capability.
Know when Apache Pulsar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Authenticated user (PR:L) over the network; multiple non-attacker-controlled preconditions raise complexity (AC:H); only message injection and storage consumption, so I:L/A:L and C:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. When authorization is enabled, the WebSocket service checks only that the connecting user holds the CONSUME permission on the subscribed topic. It does not check whether the user holds the PRODUCE permission on the topic named in deadLetterTopic. The dead letter messages are then written by the WebSocket service using its own broker client identity rather than the identity of the connecting user.
As a result, an authenticated user who holds the CONSUME permission on at least one topic can cause messages to be written to a topic of their choosing in any existing namespace, including namespaces belonging to other tenants, provided the role used by the WebSocket service to connect to the brokers is authorized to produce to that topic and the topic accepts a producer that registers no schema. The dead letter producer created by the WebSocket service registers no schema, so it is rejected when the target topic has a schema and schema validation is enforced for that topic or its namespace; this setting is not enabled by default. The same user is refused when attempting to produce to that topic directly. Where automatic topic creation is enabled, which is the default, the named topic is created if it does not already exist. The issue can only be triggered when the WebSocket service is enabled, either in the broker (webSocketServiceEnabled, which is disabled by default) or as a standalone WebSocket proxy.
The impact is unauthorized injection of messages into topics the user is not permitted to produce to. The user can determine the content of the injected messages when they also control the messages on the subscribed topic. The issue does not allow reading, modifying or deleting existing messages in the target topic. Injected messages carry the dead letter message properties and a dead letter producer name, so they can be distinguished from messages produced normally; however, the values of these properties are not authenticated and should not be relied upon to establish the origin of a message. Whether an injected message has further consequences depends on how the applications consuming the target topic process it. Repeated injection also consumes storage and backlog capacity in the target namespace.
This issue affects Apache Pulsar versions from 2.3.0 before 4.0.14 and from 4.1.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Users who cannot upgrade immediately and do not require the WebSocket service should disable it. Where the WebSocket service is required, restricting network access to it and limiting the permissions granted to the role the WebSocket service uses to connect to the brokers to the namespaces WebSocket clients are intended to access reduces the exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Apache Pulsar
View allUnauthenticated role forgery in Apache Pulsar lets a client present a forged or unsigned JSON Web Token listing arbitrar
Missing authorization in Apache Pulsar's shadow topic feature allows an authenticated tenant administrator to bind a top
Apache Pulsar deployments using the filesystem packages storage provider allow an authenticated user holding packages pe
Apache Pulsar 2.8.1 through 4.0.13 and 4.1.0 through 4.2.4 can grant an authenticated low-privileged user the proxy's fu
Truncating a partitioned topic through the Apache Pulsar broker admin REST API succeeds without the caller holding tenan
Apache Pulsar 2.8.0 through 4.2.x deployments that enable package management allow an authenticated user to read package
The deprecated functions connectors endpoints (/admin/v2/functions/connectors and /admin/v3/functions/connectors) in Apa
An authenticated Apache Pulsar client that holds no permission whatsoever on a target topic can read that topic's regist
Authorization flaw in Apache Pulsar's Functions Worker trigger REST endpoint allows an authenticated user who holds func
Authorization bypass in Apache Pulsar (2.8.0 through 4.0.13 and 4.1.0 through 4.2.4) allows an authenticated user holdin
Missing authorization checks in the Apache Pulsar broker admin REST endpoints for non-persistent topics allow an authent
Cross-tenant information disclosure in Apache Pulsar's transaction administration REST API allows any authenticated user
Exploit-DB