Severity:
CVSS 4.0: 6.0 (medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected versions:
- Apache Pulsar 2.8.0 before 4.0.14
- Apache Pulsar 4.1.0 through 4.1.3
- Apache Pulsar 4.2.0 before 4.2.5
Description:
When package management is enabled, Pulsar Functions, Sources and Sinks can be
registered or updated from a package stored in the Pulsar Packages Management
Service by supplying a package URL. The Pulsar Functions worker authorized
these requests only against the namespace in which the component was being
registered or updated. It did not check whether the requesting user was
permitted to access packages in the namespace that the package URL refers to,
and it retrieved the package from the broker using the worker's own
credentials. The permission check of the Packages Management Service was
therefore applied to the worker's identity instead of the requesting user's.
Package URLs of transform functions supplied when registering or updating a
sink were handled in the same way.
An authenticated user who is permitted to register or update functions, sources
or sinks in any namespace of their own tenant could use this to obtain the
contents of a package stored in a namespace of another tenant, without having
the packages permission on that namespace. The impact is limited to disclosure
of package contents, which may include application code, business logic or
embedded credentials. The issue does not allow packages to be modified or
deleted and does not affect availability.
This issue only affects deployments that have authentication and authorization
enabled and in which package management has been enabled: the broker setting
enablePackagesManagement and, in current releases, the functions worker setting
functionsWorkerEnablePackageManagement. Both settings are disabled by default.
This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14, from 4.1.0
through 4.1.3, and from 4.2.0 before 4.2.5.
- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
Users operating versions prior to those listed above should upgrade to the
aforementioned patched versions or newer versions.
The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The
supported versions schedule is available at
https://pulsar.apache.org/contribute/release-policy/.
Credit:
Han, JunGyu (finder)
References:
https://pulsar.apache.org/security/CVE-2026-105930/
https://pulsar.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-105930
