EUVD-2026-107476
GHSA-2wv9-w73c-5j3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as user with namespace consume permission
-
ExploitInvoke namespace/bundle clear-backlog or unsubscribe REST API
-
ExecutionBypass unenforced subscription policy check
-
ImpactAdvance cursor, discard unacked or un-replicated messages
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires ALL of the following: (1) authentication and authorization enabled on the broker; (2) the affected namespace configured with Prefix subscription authentication mode OR explicit per-subscription permission grants - this is NOT the default; (3) the default authorization provider in use; and (4) the attacker possessing an authenticated role with only consume permission on the namespace (or topic, for the expire-all operation). No tenant-admin or superuser access is needed. Limiting factors that reduce real-world risk: default deployments without Prefix subscription auth mode or subscription permissions are entirely unaffected (ordinary consume permission already authorizes these operations there), custom authorization providers may differ, and all brokers must be running vulnerable code. Impact is confined to subscription-state integrity (cursor advancement, subscription deletion, and skipping of not-yet-replicated geo-replication messages); it does not expose message contents or affect broker availability. |
| Impact | This is a low-priority, authorization-bypass (CWE-863) integrity issue that should NOT be treated as an emergency despite the 'Authentication Bypass' tag - the signals consistently point to low real-world risk. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N) scores only 2.3: network-reachable but requiring an authenticated role (PR:L), a present attack requirement (AT:P - a non-default namespace configuration), and yielding only low integrity impact (VI:L) with no confidentiality, availability, or scope impact. No EPSS score, no KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the severity label and the metrics once read carefully: the 'Authentication Bypass' tag overstates impact - this is an authorization/policy-enforcement gap for an already-authenticated principal, not an authentication bypass that grants anonymous access. The one caveat defenders should verify: the entire bypass only applies when a namespace is configured with Prefix subscription authentication mode or per-subscription permissions AND the default authorization provider is in use; custom authorization providers may behave differently per the advisory, so verify your authz configuration before dismissing. |
| Exploit ScenarioDerived | In a Pulsar cluster with authentication/authorization enabled and a namespace using Prefix subscription authentication mode (or per-subscription grants), an authenticated tenant user holding only namespace-level consume permission calls the namespace-level clear-backlog admin REST API against a subscription they were never granted access to, advancing its cursor and discarding the backlog. No public exploit code is identified; exploitation is a straightforward authenticated admin-API call requiring no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authorization bypass in Apache Pulsar (2.8.0 through 4.0.13 and 4.1.0 through 4.2.4) allows an authenticated user holding only namespace- or topic-level consume permission to clear backlogs, expire messages for all subscriptions, or delete subscriptions that the namespace's Prefix subscription authentication mode or per-subscription role grants should deny them. The flaw only affects brokers with authentication/authorization enabled, the default authorization provider in use, and namespaces that actually configure Prefix subscription auth mode or explicit subscription permissions; default deployments are unaffected because consume permission already authorizes these operations there. Impact is limited to subscription-state integrity - cursor advancement, subscription removal, and skipping of not-yet-replicated geo-replication messages - with no message disclosure, no policy modification, and no broker availability impact; no public exploit identified at time of analysis and CVSS scores remain low (2.3 per the vendor's CVSS 4.0 vector).
RemediationAI
Vendor-released patch: upgrade 4.0.x deployments to at least Apache Pulsar 4.0.14 and 4.1.x/4.2.x deployments to at least 4.2.5 (see https://pulsar.apache.org/security/CVE-2026-105938/ and the announcement at https://lists.apache.org/thread.html/zhc6wjydybdd1msnlcxmmbg8oj0kjmog). Plan a full rolling upgrade of every broker rather than a partial one, since unpatched brokers will still bypass the namespace-level subscription checks when they receive internal per-bundle requests, leaving the cluster only partially protected. If immediate upgrade is not possible, the vendor-endorsed compensating control is to restrict network access to the broker's admin REST API to trusted administrative clients (via network policy, firewall rules, or a reverse proxy with client-certificate or IP allowlisting), with the trade-off that legitimate admin tooling, CI pipelines, and monitoring integrations must be re-homed onto trusted hosts; a second, narrower option is to avoid Prefix subscription authentication mode and per-subscription grants in favour of namespace-level permissions, at the cost of losing per-subscription isolation. Operators using custom authorization providers should verify their implementation independently, since the documented impact assumes the default provider. Detection can focus on admin REST audit logs showing clear-backlog, unsubscribe, or expire-messages calls made by roles that hold only consume permission on namespaces where subscription-level restrictions are configured.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Pulsar, the distributed pub/sub messaging platform, enforces subscription-level authorization through two mechanisms: the Prefix authentication mode (a subscription name must begin with the authenticated role name) and explicit role grants on individual subscriptions. Consume, skip, cursor-reset and subscription-delete operations invoked at the topic level correctly consult these policies. The defect (CWE-863, Incorrect Authorization) is that several admin REST API handlers acted on subscriptions without routing through that policy check: namespace-level and bundle-level clear-backlog (both for a named subscription and for all subscriptions), the corresponding unsubscribe operations, and the topic-level expire-messages-for-all-subscriptions call. Under Pulsar's default authorization provider (PulsarAuthorizationProvider), those namespace-level paths only require consume permission on the namespace, and the expire-all path only requires consume permission on the topic, so a role that should be blocked by subscription policies can still mutate subscription state. Bundle-level calls are especially relevant in a clustered deployment: the namespace-level handler fans out internal per-bundle requests, and a broker that has not been upgraded will continue to skip the policy check even if its peers have been fixed. The clear-backlog variant additionally reaches the cursors used for geo-replication, so messages not yet replicated to a remote cluster can be skipped. The fix makes named-subscription operations apply subscription policies, restricts all-subscription operations for non-admin callers to subscriptions the caller may access, requires tenant-admin or superuser for geo-replication cursor backlog clearing, and applies the checks uniformly across authentication data types including the anonymous user role. The supplied CPE (cpe:2.3:a:apache_software_foundation:apache_pulsar:*:*:*:*:*:*:*:*) is a wildcard and does not encode the version boundaries, so the vendor advisory ranges are the authoritative scope.
Know when Apache Pulsar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege user (PR:L) calls a network admin REST API (AV:N/AC:L) to alter subscription-cursor state (I:L); no confidentiality or availability impact and no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, such as consuming, skipping messages, resetting a cursor or deleting a subscription, apply these subscription policies. Several admin REST API operations that act on subscriptions did not apply them:
- the namespace-level and bundle-level clear backlog operations, both for a named subscription and for all subscriptions;
- the namespace-level and bundle-level unsubscribe operations;
- the topic-level operation that expires messages for all subscriptions of a topic.
With the default authorization provider, the namespace-level operations require only consume permission granted on the namespace, and the expire-all operation requires only consume permission on the topic. As a result, when authentication and authorization are enabled and a namespace uses the Prefix subscription authentication mode or subscription permissions, an authenticated user with such consume permission can clear the backlog of, expire messages of, or delete a subscription that the policies would deny to that user. Tenant admin or superuser access is not required. The clear backlog operations can also be applied to the cursors used for geo-replication, so that messages not yet replicated to a remote cluster are skipped. Deployments that do not configure the Prefix subscription authentication mode or subscription permissions (the defaults) are not affected by this bypass, because consume permission on the namespace or topic already allows these operations there. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.
The impact is on the integrity of subscription state. Clearing or expiring the backlog moves the subscription's cursor forward, so unacknowledged messages are no longer delivered to the subscription's consumers. The unsubscribe operation deletes a subscription that has no connected consumers. Skipped messages can be permanently deleted once no other subscription or the namespace's retention policy keeps them. The issue does not allow reading message contents, changing permissions or policies, or accessing other namespaces, and it does not affect the availability of the broker.
In fixed versions, the namespace-level and bundle-level operations for a named subscription apply the subscription policies to that subscription, and the operations for all subscriptions, when requested by a user who is not a tenant admin or superuser, only act on the subscriptions that the user may access. Clearing the backlog of geo-replication cursors requires tenant admin or superuser access. Topic-level subscription operations apply the subscription policies for all types of authentication data, including that of the anonymous user role.
This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
All brokers in a cluster must be upgraded before relying on the namespace-level restrictions, because brokers that have not been upgraded do not apply them when they receive the internal per-bundle requests.
Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Users who cannot upgrade immediately can reduce exposure by restricting network access to the broker's admin REST API to trusted administrative clients.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Apache Pulsar
View allUnauthenticated role forgery in Apache Pulsar lets a client present a forged or unsigned JSON Web Token listing arbitrar
Missing authorization in Apache Pulsar's shadow topic feature allows an authenticated tenant administrator to bind a top
Apache Pulsar deployments using the filesystem packages storage provider allow an authenticated user holding packages pe
Apache Pulsar 2.8.1 through 4.0.13 and 4.1.0 through 4.2.4 can grant an authenticated low-privileged user the proxy's fu
Truncating a partitioned topic through the Apache Pulsar broker admin REST API succeeds without the caller holding tenan
Apache Pulsar 2.8.0 through 4.2.x deployments that enable package management allow an authenticated user to read package
The deprecated functions connectors endpoints (/admin/v2/functions/connectors and /admin/v3/functions/connectors) in Apa
An authenticated Apache Pulsar client that holds no permission whatsoever on a target topic can read that topic's regist
Authorization flaw in Apache Pulsar's Functions Worker trigger REST endpoint allows an authenticated user who holds func
Missing authorization checks in the Apache Pulsar broker admin REST endpoints for non-persistent topics allow an authent
Cross-tenant information disclosure in Apache Pulsar's transaction administration REST API allows any authenticated user
Apache Pulsar's WebSocket service performs an incomplete authorization check when a WebSocket consumer supplies a dead l
Exploit-DB