Severity:
CVSS 4.0: 7.2 (high)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected versions:
- Apache Pulsar 2.8.0 before 4.0.14
- Apache Pulsar 4.1.0 before 4.2.5
Description:
The Apache Pulsar broker admin REST API provides a truncate operation for
persistent topics (DELETE
/admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic
moves all subscription cursors of the topic to the end of the topic and deletes
the topic's inactive ledgers. Truncating a non-partitioned topic, or a single
partition addressed by its partition name, correctly requires the tenant admin
role or the superuser role. When the operation is requested for the name of a
partitioned topic, the broker does not apply this tenant admin check to the
caller. Instead, it truncates each partition using the broker's own internal
admin client, which authenticates with the broker's configured client
credentials rather than the caller's identity. Each per-partition truncate
request is still checked for the tenant admin role or the superuser role, but
against the broker's internal identity instead of the caller. The partitions
are therefore truncated only when the broker's configured client role is a
superuser or an admin of the target tenant, which is the usual configuration
when authorization is enabled.
As a result, when that condition holds, an authenticated user who is not a
tenant admin can truncate any partitioned topic on which the user has lookup
permission. Caller authentication and lookup permission alone are not
sufficient: if the broker's internal identity lacks tenant admin or superuser
authorization for the target tenant, the per-partition requests are rejected.
With the default authorization provider, lookup permission is granted by
produce or consume permission on the topic or its namespace. A user with no
permissions on the topic cannot trigger the issue. This impact analysis assumes
that Pulsar has been configured with the default authorization provider. For
custom authorization providers, the impact could be different.
Truncating a partitioned topic this way moves the cursors of all subscriptions
on every partition to the end of the topic, so any unacknowledged backlog is
skipped and is no longer delivered to consumers. It also deletes eligible older
ledgers of each partition regardless of the namespace's configured retention
policy, so messages stored in those ledgers can be permanently lost. The ledger
currently being written is not deleted by the truncate operation. The issue
does not allow reading message contents or changing permissions or
configuration, and it does not give access to topics on which the user has no
lookup permission.
This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from
4.1.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
Users operating versions prior to those listed above should upgrade to the
aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The
supported versions schedule is available at
https://pulsar.apache.org/contribute/release-policy/.
Users who cannot upgrade immediately can reduce exposure by restricting network
access to the broker's admin REST API (/admin/v2) to trusted administrative
clients.
Credit:
Mingsheng Lin of Institute of Information Engineering, CAS (finder)
Xingchen Chen of Institute of Information Engineering, CAS (finder)
Qixu Liu of Institute of Information Engineering, CAS (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105934/
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105934
