Apache Pulsar CVE-2026-105930

Requires ALL of: (1) authentication and authorization enabled on the cluster; (2) package management enabled - broker setting enablePackagesManagement and, in current releases, functions-worker setting functionsWorkerEnablePackageManagement, both disabled by default; and (3) an authenticated principal holding register/update permission for functions, sources, or sinks in at least one namespace of their own tenant. The attack is performed by supplying a package URL (including transform-function package URLs on sink registration) that references another tenant's namespace. Limiting factors: exploitation is impossible on default configurations, needs valid credentials with component-management rights, and only discloses package contents - it cannot modify or delete packages or affect availability.

This is a moderate, config-dependent authorization flaw (CWE-863) rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the 6.0 MEDIUM score are consistent with the description: exploitation is network-reachable but requires an authenticated user (PR:L) who already holds function/source/sink register-or-update rights, and a specific precondition must hold (AT:P - package management enabled on both broker and worker, both off by default). No EPSS score, CISA KEV entry, or public PoC was supplied, so by the precision rules there is no public exploit identified at time of analysis and no evidence of active exploitation - signals do not conflict, they simply all point to low current exploitation pressure. Impact is confidentiality-only (VC:H, VI:N, VA:N): cross-tenant disclosure of package contents that may embed source code, business logic, or credentials, with no integrity or availability effect. The main risk amplifier is the AT:P precondition being rarer than a default-config flaw, which meaningfully narrows the exposed population. Net: a real but prioritizable issue - patch during normal cycles, prioritized higher only for multi-tenant Pulsar deployments that have deliberately enabled package management.

In a multi-tenant Pulsar cluster with package management enabled, an authenticated tenant A user who can register or update a function, source, or sink supplies a package URL pointing at a namespace belonging to tenant B. The functions worker authorizes the request only against tenant A's namespace and then fetches the package from the broker using the worker's own credentials, returning tenant B's package contents to the attacker. No public exploit is identified at time of analysis, but the technique requires only crafting a package URL and ordinary register/update API access.