CVE-2026-105932 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar deployments, especially those with authentication and authorization enabled, should assess exposure and verify access controls for non-persistent topic entry filter policies.

Why it matters

CVE-2026-105932 allows authenticated users with produce or consume permissions to modify topic-level entry filter policies in Apache Pulsar, potentially leading to unauthorized access or data tampering. Defenders should verify access controls, update permissions, and monitor policy operations.

• Authenticated users with limited permissions can modify topic-level entry filter policies
• Potential for unauthorized access to sensitive topic data
• Need for verification of access controls and user permissions
• Possible impact on data integrity and confidentiality

Technical summary

The Apache Pulsar broker admin REST API provides endpoints to read, set, and remove topic-level entry filter policies for topics. For persistent topics, these endpoints check that the caller is authorized for the entry filters topic policy operation. However, the corresponding endpoints for non-persistent topics do not perform this authorization check. Instead, they perform an indirect lookup permission check while retrieving the topic's partition metadata. This can allow an authenticated user with produce or consume permission on a non-persistent topic or its namespace, but without permission to manage the topic's policies, to read, replace, or remove the topic-level entry filter policy of that topic.

Defensive priority

Defenders should prioritize verifying and restricting access to non-persistent topic entry filter policies in Apache Pulsar, especially for users with produce or consume permissions.

Recommended defensive actions

• Verify and restrict access to non-persistent topic entry filter policies in Apache Pulsar
• Review and update permissions for users with produce or consume permissions on non-persistent topics or their namespaces
• Monitor and audit topic-level entry filter policy operations in Apache Pulsar
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions (Apache Pulsar 3.3.0 up to 4.0.13 and 4.1.0 up to 4.2.4) and the lack of authorization checks for non-persistent topic entry filter policy operations. Defenders should verify access controls, focusing on users with produce or consume permissions, and monitor policy operations. The CVE Program and NVD provide additional context on the vulnerability's impact and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.