CVE-2026-105936 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar instances, especially those with authentication and authorization enabled, should assess their exposure to this vulnerability and verify that access controls are properly configured for the Functions connectors endpoint.

Why it matters

CVE-2026-105936 allows authenticated clients to read the connector catalog in Apache Pulsar without required super-user permissions when authorization is enabled. Defenders should verify exposure, assess potential impact, and update access controls to prevent unauthorized access.

• Potential unauthorized access to connector catalog information
• Possible misuse of connector information for further exploitation
• Need for verification of current access controls and connector catalog exposure
• Requirement for updating access controls to prevent unauthorized catalog access

Technical summary

The Apache Pulsar Functions worker REST API has two endpoints for retrieving the catalog of Pulsar IO connectors: the worker connectors endpoint and the deprecated functions connectors endpoint. The worker connectors endpoint requires super-user access when authorization is enabled, but the functions connectors endpoint does not apply this check. As a result, any authenticated client can read the connector catalog through the functions connectors endpoint, regardless of their role's permissions, without needing super-user access.

Defensive priority

Defenders should prioritize verifying exposure of Apache Pulsar instances, especially those with authentication and authorization enabled, and assess the impact of potential unauthorized connector catalog access.

Recommended defensive actions

• Verify Apache Pulsar instance exposure, especially with authentication and authorization enabled
• Assess potential unauthorized connector catalog access impact
• Review and update access controls for the Functions connectors endpoint
• Monitor for suspicious activity related to connector catalog access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Apache Pulsar's Functions connectors list endpoint. The issue allows authenticated clients to read the connector catalog without super-user access when authorization is enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.