Severity:
CVSS 4.0: 2.3 (low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected versions:
- Apache Pulsar 3.3.0 before 4.0.14
- Apache Pulsar 4.1.0 before 4.2.5
Description:
The Apache Pulsar broker admin REST API provides endpoints to read, set and
remove the topic-level entry filter policy of a topic. For persistent topics
these endpoints check that the caller is authorized for the entry filters topic
policy operation. The corresponding endpoints for non-persistent topics
(/admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters) do not
perform this authorization check. The only authorization check these endpoints
perform is an indirect lookup permission check, made while the topic's
partition metadata is retrieved; it is present in all affected versions.
As a result, when authentication and authorization are enabled, an
authenticated user who has been granted produce or consume permission on a
non-persistent topic, or on its namespace, but not permission to manage the
topic's policies can read, replace or remove the topic-level entry filter
policy of that topic. These operations should be restricted to users with the
tenant admin role or the superuser role. This impact analysis assumes that
Pulsar has been configured with the default authorization provider. For custom
authorization providers, the impact could be slightly different.
The practical impact is limited by two broker configuration requirements,
neither of which is met by default:
- Entry filters must have been installed by the operator. Entry filter
implementations are loaded only at broker startup from the broker's entry
filters directory, which is empty by default. A request can only select among
entry filters the operator has already deployed; setting any other filter name
is rejected. The issue does not allow a caller to install or load entry filter
code or to run arbitrary code in the broker.
- Topic-level entry filter policies must be allowed to override the
broker-level configuration (allowOverrideEntryFilters, which is disabled by
default). When this setting is disabled, the topic-level entry filter policy
has no effect on message dispatch.
In deployments where both conditions are met, an unauthorized user can remove
the topic-level entry filter policy of a non-persistent topic, for example one
used to restrict which messages are delivered to consumers, or apply a
different installed entry filter that withholds messages from subscriptions of
that topic. Removing it makes the topic fall back to the namespace-level or
broker-level entry filters, which are not removed. A changed policy affects
only subscription dispatchers created after the change, for example for new
subscriptions or when a subscription is re-created after all of its consumers
have disconnected; dispatchers that already exist keep the entry filters they
were created with. Because non-persistent topics do not store messages,
messages withheld by an entry filter are not delivered. Reading the policy
discloses only the names of the configured entry filters. The issue does not
allow reading message contents, and entry filters cannot modify message
payloads. Persistent topics and namespace-level entry filter policies are not
affected. Apache Pulsar versions before 3.3.0 are not affected, because in
those versions the entry filters topic policy check is made in code shared by
the persistent and non-persistent endpoints.
This issue affects Apache Pulsar versions from 3.3.0 before 4.0.14 and from
4.1.0 before 4.2.5.
- 3.3.x and 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
Users operating versions prior to those listed above should upgrade to the
aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The
supported versions schedule is available at
https://pulsar.apache.org/contribute/release-policy/.
Users who cannot upgrade immediately and have deployed entry filters should
keep allowOverrideEntryFilters at its default value of false, so that
topic-level entry filter policies do not affect message dispatch.
Credit:
yangxi739 (finder)
n0mi1k (finder)
Mingsheng Lin of Institute of Information Engineering, CAS (finder)
Xingchen Chen of Institute of Information Engineering, CAS (finder)
Qixu Liu of Institute of Information Engineering, CAS (finder)
sec-reex (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105932/
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105932
