Apache Pulsar CVE-2026-105936

Exploitation requires that both authentication and authorization are enabled on Pulsar and that the attacker holds a valid authenticated role (PR:L); the deprecated functions connectors endpoints (/admin/v2/functions/connectors, /admin/v3/functions/connectors) must be reachable on a functions worker or on a broker running the functions worker. The flaw affects default behavior of those endpoints - no non-default feature toggle is needed. Limiting factors: unauthenticated requests are rejected outright (unless the operator has explicitly configured anonymous access with an anonymous user role, which would let anonymous callers reach it); impact is confined to disclosure of connector-type metadata, and an equivalent listing is already available to authenticated clients via the built-in sources and sinks endpoints, reducing the practical value of the leak.

This is a low-to-moderate priority issue that should be patched during normal maintenance rather than as an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the matching CWE-862 (Missing Authorization) are internally consistent with the description: exploitation is network-reachable and low-complexity, but PR:L confirms a valid authenticated role is required, so this is not an unauthenticated internet-facing flaw. The impact metrics (VC:L, VI:N, VA:N) correctly cap this at low-confidentiality metadata disclosure with no integrity or availability effect and no scope change - the attacker cannot modify the catalog or manage connectors. No EPSS score, no CISA KEV listing, and no public POC were supplied, which is coherent with a low-severity information-disclosure issue; none of these signals conflict with the CVSS picture. The main nuance to verify is that the disclosed data is only connector-type metadata (names, descriptions, class names) and explicitly NOT configuration values, credentials, or running-instance data, and that the same source/sink definitions are already reachable by authenticated clients via the built-in sources/sinks endpoints - meaning real-world marginal risk is small. The input 'Authentication Bypass' tag overstates the issue; this is an authorization (access-control) gap for already-authenticated users, not an authentication bypass.

An authenticated but low-privileged client (any valid non-super-user role, or an anonymous role if anonymous access is configured) issues a request to /admin/v2/functions/connectors or /admin/v3/functions/connectors against a functions worker or a broker running the functions worker. Because that endpoint omits the super-user check, the client receives the full connector catalog, revealing the names, descriptions, and source/sink/config class names of connectors the operator installed - including custom ones. No public exploit identified at time of analysis; exploitation is a single authenticated REST call requiring no special tooling.