CVE-2026-105935 Apache Software Foundation CVE debrief

Who should care

Defenders managing Apache Pulsar deployments, especially those with authentication and authorization enabled, should assess exposure and potential impact. This includes operators, platform administrators, and security teams responsible for vulnerability management and ensuring the security of message processing workflows.

Why it matters

Defenders should care about CVE-2026-105935 because it allows authenticated users with function management permissions to publish messages to input topics without proper authorization, potentially disrupting message processing workflows and impacting data integrity.

• Potential unauthorized message publication to input topics
• Possible disruption of message processing workflows
• Need for verification of produce permissions for function triggers
• Potential for data integrity issues if exploited

Technical summary

The Apache Pulsar Functions Worker provides a REST API endpoint for triggering functions, which can publish to input topics without checking caller produce permissions. This issue exists in versions 2.4.0 and later. Earlier versions lack caller authorization checks for the trigger endpoint. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured broker-client credentials rather than the credentials of the API caller. When authorization is enabled, in Apache Pulsar 2.4.0 and later versions, the trigger endpoint checks only that the caller is authorized to perform function operations in the function's namespace. It does not check that the caller is

Defensive priority

Defenders should prioritize verifying exposure in Apache Pulsar deployments, especially where authentication and authorization are enabled, and assessing the impact of potential unauthorized message publication.

Recommended defensive actions

• Verify Apache Pulsar deployments for exposure to this vulnerability
• Assess the impact of potential unauthorized message publication
• Check for and apply vendor-provided patches or updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records provide details on the vulnerability in Apache Pulsar's Functions Worker. The issue arises from the lack of produce permission checks for callers triggering functions that publish to input topics.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.