Apache Pulsar vulnerabilities

• apache pulsar, apache software foundation pulsar io kafka connect adaptor, pulsar io kafka connector +2 more Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors CVE-2025-30677 Fix available 6.3 MediumApril 9, 2025
• apache pulsar Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints CVE-2024-29834 Fix available 6.4 MediumApril 2, 2024
• apache pulsar Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVE-2024-27894 Fix available 8.5 HighMarch 12, 2024
• apache pulsar Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVE-2024-27317 Fix available EPSS 56.9% 8.4 HighMarch 12, 2024
• apache pulsar Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVE-2024-27135 Fix available 8.5 HighMarch 12, 2024
• apache pulsar Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVE-2022-34321 Fix available 8.2 HighMarch 12, 2024
• apache pulsar Apache Pulsar: Improper Authorization For Topic-Level Policy Management CVE-2024-28098 Fix available 6.4 MediumMarch 12, 2024
• apache pulsar Apache Pulsar: Timing attack in SASL token signature verification CVE-2023-51437 Fix available 7.4 HighFebruary 7, 2024
• apache pulsar, apache software foundation pulsar websocket proxy +1 more Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS CVE-2023-37544 Fix available 7.5 HighDecember 20, 2023
• apache pulsar, apache software foundation pulsar broker +1 more Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer CVE-2023-30428 Fix available 8.2 HighJuly 12, 2023
• apache pulsar Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVE-2023-30429 Fix available 9.6 CriticalJuly 12, 2023
• apache pulsar Apache Pulsar: Broker does not always disconnect client when authentication data expires CVE-2023-31007 Fix available 0.0 NoneJuly 12, 2023
• apache pulsar, apache software foundation pulsar function worker +1 more Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials CVE-2023-37579 Fix available 8.2 HighJuly 12, 2023
• apache pulsar Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation CVE-2022-33684 Fix available 8.1 HighNovember 4, 2022
• apache pulsar Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack CVE-2022-33683 Fix available 5.9 MediumSeptember 23, 2022
• apache pulsar Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack CVE-2022-33682 Fix available 5.9 MediumSeptember 23, 2022
• apache pulsar Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM CVE-2022-33681 Fix available 5.9 MediumSeptember 23, 2022
• apache pulsar Apache Pulsar Proxy target broker address isn't validated CVE-2022-24280 Fix available 6.5 MediumSeptember 23, 2022
• apache pulsar Pulsar Admin API allows access to data from other tenants using getMessageById API CVE-2021-41571 Fix available 6.5 MediumFebruary 1, 2022
• apache pulsar Authentication with JWT allows use of “none”-algorithm CVE-2021-22160 Fix available EPSS 52.9% 9.8 CriticalMay 26, 2021
• apache pulsar manager In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's... CVE-2020-17520 6.5 MediumDecember 18, 2020