CVE-2026-105927 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar deployments, especially those using WebSocket consumers, should assess exposure and prioritize mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and mitigate the vulnerability to prevent potential data tampering and unauthorized modifications.

Why it matters

CVE-2026-105927 allows authenticated users to write messages to topics without PRODUCE permission, requiring defenders to verify and mitigate the vulnerability.

• Authenticated users can write messages to topics without PRODUCE permission, potentially leading to unauthorized data modifications.
• Defenders need to verify and mitigate this vulnerability to prevent potential data tampering.
• Remediation priority is high for deployments using WebSocket consumers.

Technical summary

The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters. When authorization is enabled, the WebSocket service checks only that the connecting user holds the CONSUME permission on the subscribed topic. It does not check whether the user holds the PRODUCE permission on the topic named in deadLetterTopic. This allows an authenticated user who holds the CONSUME permission on at least one topic to cause messages to be written to a topic of their choosing in any existing namespace.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in Apache Pulsar deployments, especially where WebSocket consumers are used.

Recommended defensive actions

• Verify Apache Pulsar version and apply patches or updates as available.
• Review WebSocket consumer configurations and restrict dead letter topic access.
• Monitor for suspicious activity and implement compensating controls as needed.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, including its description, CVSS score, and affected versions. The WebSocket service in Apache Pulsar allows a consumer to configure a dead letter policy through query parameters. When authorization is enabled, it checks for CONSUME permission on the subscribed topic but not for PRODUCE permission on the dead letter topic. This oversight allows an authenticated user with CONSUME permission to write messages to any topic, provided the WebSocket service has PRODUCE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.