Apache Software Foundation Apache Pulsar vulnerabilities

CVE-2024-27317 [CRITICAL] CWE-22 CVE-2024-27317: In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These file In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain

CVE-2021-22160 [CRITICAL] CWE-347 CVE-2021-22160: If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).

CVE-2024-27135 [CRITICAL] CWE-20 CVE-2024-27135: Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to exe Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issu

CVE-2026-105869 [CRITICAL] CWE-347 CVE-2026-105869: Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed the token's claims with the signature removed and

CVE-2026-105937 [HIGH] CWE-862 CVE-2026-105937: Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic fro Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of

CVE-2024-27894 [HIGH] CWE-20 CVE-2024-27894: The Pulsar Functions Worker includes a capability that permits authenticated users to create functio The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will retrieve the implementation from the URL provided by the

CVE-2023-30429 [HIGH] CWE-863 CVE-2023-30429: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affec Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incorrectl

CVE-2026-105942 [HIGH] CWE-863 CVE-2026-105942: When a configured proxy role sends a request to the broker on behalf of another user (the original p When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check. First

CVE-2026-105945 [HIGH] CWE-22 CVE-2026-105945: The Pulsar Packages Management Service can be configured to store packages on the local filesystem o The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is deriv

CVE-2022-34321 [HIGH] CWE-306 CVE-2022-34321: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /p Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections without requiring proper authentication credentials. Th

CVE-2026-105934 [HIGH] CWE-862 CVE-2026-105934: The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addr

CVE-2022-33684 [HIGH] CWE-295 CVE-2022-33684: The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the O The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or modify the GET request that is sent to the ClientCredent

CVE-2023-51437 [HIGH] CWE-203 CVE-2023-51437: Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleT

CVE-2026-105930 [MEDIUM] CWE-863 CVE-2026-105930: When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component was being registered or updated. It did not check wh

CVE-2026-105936 [MEDIUM] CWE-862 CVE-2026-105936: The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO con The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors). When authorization is enabl

CVE-2021-41571 [MEDIUM] CWE-863 CVE-2021-41571: In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics ac In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed aga

CVE-2023-31007 [MEDIUM] CWE-287 CVE-2023-31007: Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a cl Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially c

CVE-2024-29834 [MEDIUM] CWE-863 CVE-2024-29834: This vulnerability allows authenticated users with produce or consume permissions to perform unautho This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can creat

CVE-2026-105926 [MEDIUM] CWE-862 CVE-2026-105926: The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the sc The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which registers a new schema version for an existing topic. The broker handled both commands after checking only that the client connection was authenticated. Unlike the broker's other topic comman

CVE-2026-105935 [MEDIUM] CWE-862 CVE-2026-105935: The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured broker-client credentials rather than the credentials of