Apache Software Foundation Apache Pulsar

CVE-2026-105945 High 7.7 Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage 0.5%
CVE-2026-105942 High 7.7 Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation 0.5%
CVE-2026-105938 Low 2.3 Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all 0.5%
CVE-2026-105937 High 8.7 Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data 0.2%
CVE-2026-105936 Medium 5.3 Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint 0.5%
CVE-2026-105935 Medium 4.9 Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission 0.4%
CVE-2026-105934 High 7.2 Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic 0.5%
CVE-2026-105933 Low 2.3 Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization 0.3%
CVE-2026-105932 Low 2.3 Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints 0.5%
CVE-2026-105931 Low 2.3 Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants 0.5%
CVE-2026-105930 Medium 6.0 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download 0.5%
CVE-2026-105927 Low 2.3 Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission 0.4%
CVE-2026-105926 Medium 5.3 Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands 0.4%
CVE-2026-105869 Critical 9.2 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role 0.3%
CVE-2024-29834 Medium 6.4 Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints 1.4%
CVE-2024-27894 High 8.5 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying 1.9%
CVE-2024-27317 High 8.4 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification 56.9%
CVE-2024-27135 High 8.5 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution 6.0%
CVE-2022-34321 High 8.2 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint 1.8%
CVE-2024-28098 Medium 6.4 Apache Pulsar: Improper Authorization For Topic-Level Policy Management 1.7%
CVE-2023-51437 High 7.4 Apache Pulsar: Timing attack in SASL token signature verification 0.8%
CVE-2023-30429 Critical 9.6 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy 1.0%
CVE-2023-31007 None 0.0 Apache Pulsar: Broker does not always disconnect client when authentication data expires 1.0%
CVE-2022-33684 High 8.1 Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation 0.9%
CVE-2022-33683 Medium 5.9 Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack 0.7%
CVE-2022-33682 Medium 5.9 Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack 0.7%
CVE-2022-33681 Medium 5.9 Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM 0.7%
CVE-2022-24280 Medium 6.5 Apache Pulsar Proxy target broker address isn't validated 1.5%
CVE-2021-41571 Unrated Pulsar Admin API allows access to data from other tenants using getMessageById API 1.7%
CVE-2021-22160 Unrated Authentication with JWT allows use of “none”-algorithm 52.9%