Severity:
CVSS 4.0: 5.3 (medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:L
Affected versions:
- Apache Pulsar 2.2.0 before 4.0.14
- Apache Pulsar 4.1.0 through 4.1.3
- Apache Pulsar 4.2.0 before 4.2.5
Description:
The Pulsar broker serves two schema commands on its binary protocol: GetSchema,
which returns the schema registered for a topic, and GetOrCreateSchema, which
registers a new schema version for an existing topic. The broker handled both
commands after checking only that the client connection was authenticated.
Unlike the broker's other topic commands, such as those for creating producers
and consumers or for looking up topics, these two commands did not check
whether the authenticated client was authorized for the target topic. The
Pulsar REST API endpoints for schemas were not affected.
An authenticated client without any permission on the target topic, namespace
or tenant could use these commands to:
- read the schema registered for a topic in another namespace or tenant,
disclosing the schema definition such as record field names and types. Message
payloads are not disclosed.
- register a new schema version on an existing topic in another namespace or
tenant. The topic's schema compatibility and schema auto-update policies still
apply. The issue does not allow message data to be read or modified, but a
registered schema version can cause legitimate producers and consumers of that
topic to fail with schema incompatibility errors until the schema is corrected
by an administrator.
The standard Pulsar client performs an authorized topic lookup before it sends
these commands, so the missing check could not be observed when testing with
the standard client. A client that implements the binary protocol directly is
not required to perform that lookup first.
This issue is relevant only to deployments that have authentication and
authorization enabled. The GetSchema command is affected from Apache Pulsar
2.2.0, and the GetOrCreateSchema command from Apache Pulsar 2.5.0. After the
fix, the broker requires the lookup permission on the topic for GetSchema and
the produce permission on the topic for GetOrCreateSchema. This impact analysis
assumes that Pulsar has been configured with the default authorization
provider. For custom authorization providers, the impact could be slightly
different.
This issue affects Apache Pulsar versions from 2.2.0 before 4.0.14, from 4.1.0
through 4.1.3, and from 4.2.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
Users operating versions prior to those listed above should upgrade to the
aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The
supported versions schedule is available at
https://pulsar.apache.org/contribute/release-policy/.
Credit:
Claude and Ada Logics (finder)
n0mi1k (finder)
MopMonk-AI (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105926/
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105926
