Severity:
CVSS 4.0: 9.2 (critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected versions:
- Apache Pulsar 2.8.1 before 4.0.14
- Apache Pulsar 4.1.0 before 4.2.5
Description:
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with
all roles listed in a claim of its JSON Web Token (JWT). The provider is
intended for use with token authentication, which verifies the token before
authorization. The provider did not verify the token itself: it parsed the
token's claims with the signature removed and trusted that authentication had
already checked it.
When authentication and authorization are enabled with a non-empty
anonymousUserRole setting, some HTTP requests whose credentials fail
authentication are not rejected, but are handled as requests of the anonymous
user role. For the broker's HTTP endpoints, such as the admin REST API, this
fallback applies to requests that do not name an authentication method and
requires strictAuthMethod to be false (the default) where that setting is
available. For the WebSocket API, failed credentials can also fall back to the
anonymous user role; this path does not enforce strictAuthMethod. The
authentication data kept for such a request still contained the request's
Authorization header. MultiRolesTokenAuthorizationProvider then read the bearer
token from that header without verifying its signature and authorized the
request with the roles in the token's role claim.
As a result, in deployments that use MultiRolesTokenAuthorizationProvider
together with a non-empty anonymousUserRole and that permit this fallback, an
unauthenticated client can send an HTTP request, for example to the admin REST
API or the WebSocket API, with a forged or unsigned token that lists arbitrary
roles, and be authorized with those roles. The impact can include super-user
access when the token lists a role configured in superUserRoles, allowing the
client to read and change tenants, namespaces, topics, permissions and broker
configuration. No valid credentials are required.
Deployments are not affected if they use the default authorization provider
(PulsarAuthorizationProvider) or another authorization provider, or if
anonymousUserRole is not set (the default). Requests that authenticate
successfully with a valid token are not affected, because the token that
MultiRolesTokenAuthorizationProvider reads is the token that authentication
verified. Connections that use the Pulsar binary protocol are not affected by
this issue, because the broker does not keep client authentication data for
connections that it assigns to the anonymous user role.
In fixed versions, MultiRolesTokenAuthorizationProvider obtains roles only from
tokens that the configured token authentication provider has verified, using
its configured keys and validation settings. Broker HTTP requests that are
assigned to the anonymous user role are authorized only as that role, and
invalid tokens cannot supply additional roles to WebSocket requests. The broker
fails to start if MultiRolesTokenAuthorizationProvider is configured with
authorization enabled but without a token authentication provider.
This issue affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from
4.1.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
Users operating versions prior to those listed above should upgrade to the
aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The
supported versions schedule is available at
https://pulsar.apache.org/contribute/release-policy/.
Users who cannot upgrade immediately can remove the anonymousUserRole setting
from the broker and WebSocket service configurations, or restrict network
access to the HTTP endpoints of these services to trusted clients.
Credit:
George Chen (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105869/
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105869
