Severity:
CVSS 4.0: 2.3 (low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Pulsar 2.8.0 before 4.0.14
- Apache Pulsar 4.1.0 before 4.2.5
Description:
Apache Pulsar namespaces can restrict which roles may use a subscription,
either with the Prefix subscription authentication mode, which requires a
subscription name to start with the role name, or by granting permission on a
subscription to specific roles. Topic-level subscription operations, such as
consuming, skipping messages, resetting a cursor or deleting a subscription,
apply these subscription policies. Several admin REST API operations that act
on subscriptions did not apply them:
- the namespace-level and bundle-level clear backlog operations, both for a
named subscription and for all subscriptions;
- the namespace-level and bundle-level unsubscribe operations;
- the topic-level operation that expires messages for all subscriptions of a
topic.
With the default authorization provider, the namespace-level operations require
only consume permission granted on the namespace, and the expire-all operation
requires only consume permission on the topic. As a result, when authentication
and authorization are enabled and a namespace uses the Prefix subscription
authentication mode or subscription permissions, an authenticated user with
such consume permission can clear the backlog of, expire messages of, or delete
a subscription that the policies would deny to that user. Tenant admin or
superuser access is not required. The clear backlog operations can also be
applied to the cursors used for geo-replication, so that messages not yet
replicated to a remote cluster are skipped. Deployments that do not configure
the Prefix subscription authentication mode or subscription permissions (the
defaults) are not affected by this bypass, because consume permission on the
namespace or topic already allows these operations there. This impact analysis
assumes that Pulsar has been configured with the default authorization
provider. For custom authorization providers, the impact could be different.
The impact is on the integrity of subscription state. Clearing or expiring the
backlog moves the subscription's cursor forward, so unacknowledged messages are
no longer delivered to the subscription's consumers. The unsubscribe operation
deletes a subscription that has no connected consumers. Skipped messages can be
permanently deleted once no other subscription or the namespace's retention
policy keeps them. The issue does not allow reading message contents, changing
permissions or policies, or accessing other namespaces, and it does not affect
the availability of the broker.
In fixed versions, the namespace-level and bundle-level operations for a named
subscription apply the subscription policies to that subscription, and the
operations for all subscriptions, when requested by a user who is not a tenant
admin or superuser, only act on the subscriptions that the user may access.
Clearing the backlog of geo-replication cursors requires tenant admin or
superuser access. Topic-level subscription operations apply the subscription
policies for all types of authentication data, including that of the anonymous
user role.
This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from
4.1.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
All brokers in a cluster must be upgraded before relying on the namespace-level
restrictions, because brokers that have not been upgraded do not apply them
when they receive the internal per-bundle requests.
Users operating versions prior to those listed above should upgrade to the
aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The
supported versions schedule is available at
https://pulsar.apache.org/contribute/release-policy/.
Users who cannot upgrade immediately can reduce exposure by restricting network
access to the broker's admin REST API to trusted administrative clients.
Credit:
Omar Mousa (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105938/
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105938
