Severity:
CVSS 4.0: 10.0 (critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected versions:
- Apache Pulsar Manager 0.1.0 through 0.4.0
Description:
Apache Pulsar Manager is a web console for administering Apache Pulsar
clusters. It has its own user accounts and login, and it can be configured with
an HTTP authentication credential, such as a token, that it uses to call the
Pulsar admin API on behalf of its users. Pulsar Manager has the following
security issues:
- The operation for creating the initial administrator (superuser) account is
available without authentication, and it remains available after the instance
has been initialized. Anyone who can reach Pulsar Manager can create an
additional administrator account at any time and log in with it. This issue
affects versions 0.3.0 and later.
- Requests to the Pulsar admin API that Pulsar Manager proxies to the
configured Pulsar cluster are not subject to Pulsar Manager's authentication.
Version 0.2.0 checks the caller's permissions for some of these requests, but
not for all of them. An unauthenticated user can therefore use Pulsar Manager
to send requests to the Pulsar admin API, which the cluster processes with the
credential configured in Pulsar Manager.
- The destination of a proxied request can be chosen by the requester, and
Pulsar Manager attaches its configured Pulsar admin credential to the request.
An unauthenticated user can make Pulsar Manager send this credential to a host
of the user's choosing, and the credential can then be used directly against
the Pulsar cluster.
- In versions 0.3.0 and later, Pulsar Manager does not distinguish between
privilege levels of its accounts. Every account, including one created through
the first issue, effectively has full administrative privileges in Pulsar
Manager.
The impact depends on the version and the deployment. In versions 0.3.0 and
later, any user who can reach Pulsar Manager over the network can take full
control of Pulsar Manager. In all versions, when Pulsar Manager is configured
with an HTTP authentication credential for a Pulsar cluster, any user who can
reach Pulsar Manager can perform the Pulsar admin operations that this
credential permits and can obtain the credential itself. When Pulsar Manager is
configured with the token signing key of a Pulsar cluster, an administrator of
Pulsar Manager can create tokens for the cluster.
Apache Pulsar Manager is no longer maintained and is completely unsupported.
The Apache Pulsar PMC has retired it. There are no supported versions, and no
further releases, fixes or security updates will be made for any version. These
issues will not be fixed.
Using Pulsar Manager is not recommended. Users should stop using Pulsar
Manager, remove existing deployments, and move to one of the alternatives
described in the Administration UI documentation
(https://pulsar.apache.org/docs/administration-ui). Users who have exposed
Pulsar Manager configured with a Pulsar credential or token signing key should
also consider replacing that credential or key.
Until a deployment is removed, users should not expose Pulsar Manager to
untrusted networks, and should restrict network access to it to trusted
administrators.
Credit:
Aleksandar Djordjevic (finder)
Mike Read (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105944/
https://pulsar.apache.org/docs/administration-ui
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105944
