CVE-2026-105930 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar instances, especially those with package management features enabled, should assess exposure and prioritize updates to prevent unauthorized package downloads.

Why it matters

CVE-2026-105930 is a medium-severity vulnerability in Apache Pulsar that allows cross-tenant package download due to improper authorization. Defenders should prioritize verifying and updating affected instances, assessing exposure of package management features, and restricting access to authorized users.

• Potential disclosure of package contents, including application code and business logic
• Possible unauthorized access to sensitive data or credentials embedded in packages
• Need for verification of affected versions and exposure of package management features
• Priority for updating and patching Apache Pulsar instances to prevent exploitation

Technical summary

The Apache Pulsar vulnerability CVE-2026-105930 allows an authenticated user to download packages from another tenant's namespace without having the necessary permissions. This is due to the Pulsar Functions worker not properly checking the requesting user's permissions when retrieving packages. The impact is limited to disclosure of package contents, which may include application code, business logic, or embedded credentials. Defenders should prioritize verifying and updating affected instances, assessing exposure of package management features, and restricting access to authorized users.

Defensive priority

Defenders should prioritize verifying and updating Apache Pulsar instances, especially for versions 2.8.0 to 4.0.14, 4.1.0 to 4.1.3, and 4.2.0 to 4.2.5, and assess exposure of package management features.

Recommended defensive actions

• Verify and update Apache Pulsar instances to the latest version
• Assess exposure of package management features in Apache Pulsar
• Restrict access to package management features to authorized users
• Monitor for suspicious package download activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the improper authorization vulnerability in Apache Pulsar, which allows cross-tenant package download. The NVD entry is currently Medium severity. Evidence is limited to CVE Program and NVD details. Defenders should verify affected Pulsar instances, especially those with package management enabled, and assess exposure to unauthorized package downloads.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.