Skip to content
Apache Software Foundation Pulsar vulnerabilities
-
apache software foundation pulsar
Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
CVE-2026-105945
7.7 High
-
apache software foundation pulsar manager
Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
CVE-2026-105944
10.0 Critical
-
apache software foundation pulsar
Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
CVE-2026-105942
7.7 High
-
apache software foundation pulsar
Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
CVE-2026-105938
2.3 Low
-
apache software foundation pulsar
Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
CVE-2026-105937
8.7 High
-
apache software foundation pulsar
Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
CVE-2026-105936
5.3 Medium
-
apache software foundation pulsar
Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
CVE-2026-105935
4.9 Medium
-
apache software foundation pulsar
Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
CVE-2026-105934
7.2 High
-
apache software foundation pulsar
Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
CVE-2026-105933
2.3 Low
-
apache software foundation pulsar
Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
CVE-2026-105932
2.3 Low
-
apache software foundation pulsar
Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
CVE-2026-105931
2.3 Low
-
apache software foundation pulsar
Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
CVE-2026-105930
6.0 Medium
-
apache software foundation pulsar
Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
CVE-2026-105927
2.3 Low
-
apache software foundation pulsar
Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
CVE-2026-105926
5.3 Medium
-
apache software foundation pulsar
Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
CVE-2026-105869
9.2 Critical
-
apache pulsar, apache software foundation pulsar io kafka connect adaptor, pulsar io kafka connector +2 more
Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors
CVE-2025-30677
Fix available
6.3 Medium
-
apache pulsar
Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints
CVE-2024-29834
Fix available
6.4 Medium
-
apache pulsar
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
CVE-2024-27894
Fix available
8.5 High
-
apache pulsar
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
CVE-2024-27317
Fix available
EPSS 56.9%
8.4 High
-
apache pulsar
Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution
CVE-2024-27135
Fix available
8.5 High
-
apache pulsar
Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint
CVE-2022-34321
Fix available
8.2 High
-
apache pulsar
Apache Pulsar: Improper Authorization For Topic-Level Policy Management
CVE-2024-28098
Fix available
6.4 Medium
-
apache pulsar
Apache Pulsar: Timing attack in SASL token signature verification
CVE-2023-51437
Fix available
7.4 High
-
apache pulsar, apache software foundation pulsar websocket proxy +1 more
Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS
CVE-2023-37544
Fix available
7.5 High
-
apache pulsar, apache software foundation pulsar broker +1 more
Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer
CVE-2023-30428
Fix available
8.2 High
-
apache pulsar
Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy
CVE-2023-30429
Fix available
9.6 Critical
-
apache pulsar
Apache Pulsar: Broker does not always disconnect client when authentication data expires
CVE-2023-31007
Fix available
0.0 None
-
apache pulsar, apache software foundation pulsar function worker +1 more
Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials
CVE-2023-37579
Fix available
8.2 High
-
apache pulsar
Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation
CVE-2022-33684
Fix available
8.1 High
-
apache pulsar
Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack
CVE-2022-33683
Fix available
5.9 Medium
-
apache pulsar
Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack
CVE-2022-33682
Fix available
5.9 Medium
-
apache pulsar
Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM
CVE-2022-33681
Fix available
5.9 Medium
-
apache pulsar
Apache Pulsar Proxy target broker address isn't validated
CVE-2022-24280
Fix available
6.5 Medium
-
apache pulsar
Pulsar Admin API allows access to data from other tenants using getMessageById API
CVE-2021-41571
Fix available
6.5 Medium
-
apache pulsar
Authentication with JWT allows use of “none”-algorithm
CVE-2021-22160
Fix available
EPSS 52.9%
9.8 Critical