CVE-2026-105931 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Pulsar deployments should assess exposure and prioritize mitigation, especially in environments with multiple tenants. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed and

Why it matters

CVE-2026-105931 exposes transaction coordinators and statistics of other tenants to authenticated users in Apache Pulsar deployments lacking proper authorization on transaction admin endpoints.

• Authenticated users can access transaction coordinators and statistics of other tenants.
• Lack of authorization checks on read endpoints allows unauthorized data exposure.
• Defenders must verify and mitigate this vulnerability to prevent data exposure.
• Remediation requires updating Apache Pulsar and enforcing proper authorization.

Technical summary

The Apache Pulsar broker exposes a transaction administration REST API that lacks proper authorization checks for read endpoints, allowing authenticated users to access transaction coordinators and statistics of other tenants. The API endpoints that modify state require super-user access and are not affected. However, the read endpoints do not check whether the caller is permitted to access the tenant, namespace, or topic whose data is returned. As a result, any authenticated user can read transaction coordinator and transaction information belonging to other tenants.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in Apache Pulsar deployments, especially where authentication is enabled but authorization is not properly enforced.

Recommended defensive actions

• Verify and update Apache Pulsar to a version that addresses this vulnerability.
• Review and enforce proper authorization for transaction admin endpoints.
• Monitor for and restrict unauthorized access to transaction coordinators and statistics.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. The CVE Program record (cve-org) and the NIST NVD detail page (nvd) offer official information on the vulnerability. Additional vendor advisories (ref-4 and ref-5) are also available. Defenders should verify the affected scope, severity, and vendor guidance to assess exposure and prioritize mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.