Apache Pulsar Manager
Monthly
Unauthenticated remote attackers can take full administrative control of Apache Pulsar Manager 0.3.0 and later by creating an administrator account through an endpoint that remains reachable after initialization, and every account has effective full privileges. In all versions, the manager proxies requests to the Pulsar admin API without enforcing its own authentication and can attach its configured Pulsar credential to a requester-chosen destination, allowing unauthenticated users to perform permitted admin operations and steal the credential. No public exploit code was identified at time of analysis, but the product is retired, unsupported, and will not receive fixes, so exposure persists until deployments are removed.
Unauthenticated remote attackers can take full administrative control of Apache Pulsar Manager 0.3.0 and later by creating an administrator account through an endpoint that remains reachable after initialization, and every account has effective full privileges. In all versions, the manager proxies requests to the Pulsar admin API without enforcing its own authentication and can attach its configured Pulsar credential to a requester-chosen destination, allowing unauthenticated users to perform permitted admin operations and steal the credential. No public exploit code was identified at time of analysis, but the product is retired, unsupported, and will not receive fixes, so exposure persists until deployments are removed.