CVE-2026-105869 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar instances, especially those with authentication and authorization enabled, should assess exposure and prioritize updates. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify instances, update to secure versions, review settings, and monitor for suspicious activity to mitigate potential unauthorized access or privilege escalation.

Why it matters

Defenders should care about CVE-2026-105869 because it allows unauthorized access to Apache Pulsar instances with authentication and authorization enabled. Roles from unverified JWT claims can be used for certain HTTP requests, potentially bypassing intended authorization. Affected instances may be exposed to unauthorized access or privilege escalation. Defenders should verify instances, update to secure versions, and monitor for suspicious activity.

• Potential unauthorized access to Pulsar instances
• Possible privilege escalation via anonymous user role
• Need for verification of affected versions and instances
• Priority for updating to a secure version

Technical summary

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes clients with roles listed in a JWT claim without verifying the token's signature. This allows HTTP requests with failed authentication to fall back to the anonymous user role, potentially bypassing intended authorization. The issue arises from the provider's trust in authentication checks without verifying the token itself. Affected instances may be exposed to unauthorized access or privilege escalation if not properly secured. Defenders should prioritize verifying and updating affected instances, especially those with authentication and authorization enabled.

Defensive priority

Defenders should prioritize verifying and updating affected Apache Pulsar instances, especially those with authentication and authorization enabled.

Recommended defensive actions

• Verify and update affected Apache Pulsar instances to a secure version
• Review and adjust authentication and authorization settings
• Monitor for suspicious activity on Pulsar instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in Apache Pulsar's MultiRolesTokenAuthorizationProvider. The NVD entry is currently not provided. Evidence is based on CVE Program and source item data, with limitations noted in source detail. Defenders should verify affected versions and instances, review authentication and authorization settings, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.