Severity:
CVSS 4.0: 2.3 (low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Pulsar 2.8.0 before 4.0.14
- Apache Pulsar 4.1.0 before 4.2.5
Description:
The Apache Pulsar broker exposes a transaction administration REST API under
/admin/v3/transactions. When authentication and authorization are enabled, most
of the read endpoints of this API verify only that the request is authenticated
and that the broker serves the requested topic or transaction coordinator. They
do not check whether the caller is permitted to access the tenant, namespace or
topic whose data is returned. The endpoints that modify state, which abort a
transaction or scale the transaction coordinators, correctly require super-user
access and are not affected.
As a result, any authenticated user, including one that has been granted no
permissions, can read transaction coordinator and transaction information
belonging to other tenants. This includes the list of transaction coordinators
with the broker service URLs that serve them, transaction coordinator
statistics and internal statistics, transaction metadata including the names of
the topics and subscriptions a transaction involves and the principal that
opened it, the list of long-running transactions on a transaction coordinator,
transaction buffer and pending acknowledgement statistics and internal
statistics for any topic and subscription, and whether a given message position
of a subscription is currently held in a pending transactional acknowledgement.
The disclosure of transaction metadata and statistics can only occur when
transaction support is enabled in the broker (transactionCoordinatorEnabled,
which is disabled by default). When transaction support is disabled, these
endpoints return no transaction data; the only residual effect is that one
endpoint's error response can reveal whether a named topic exists in another
tenant.
The impact is limited to disclosure of transaction-related metadata and
statistics across tenant boundaries. The issue does not allow reading message
contents, modifying or aborting transactions, or changing any configuration.
This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from
4.1.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
Users operating versions prior to those listed above should upgrade to the
aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The
supported versions schedule is available at
https://pulsar.apache.org/contribute/release-policy/.
Users who cannot upgrade immediately and do not use Pulsar transactions should
keep transaction support disabled. Where transactions are required, restricting
network access to the broker's admin HTTP endpoints to trusted administrative
clients reduces the exposure.
Credit:
n0mi1k (finder)
Mingsheng Lin of Institute of Information Engineering, CAS (finder)
Xingchen Chen of Institute of Information Engineering, CAS (finder)
Qixu Liu of Institute of Information Engineering, CAS (finder)
MopMonk-AI (finder)
Wanxin Yin (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105931/
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105931
