CVE-2026-105937 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar installations, especially in multi-tenant environments, should assess their exposure and take necessary actions to prevent unauthorized cross-tenant data access and manipulation.

Why it matters

CVE-2026-105937 is a high-severity vulnerability in Apache Pulsar that allows an authenticated user to access and manipulate data across tenants due to missing authorization checks. Defenders should prioritize verifying and updating their installations to prevent potential data breaches and unauthorized data manipulation.

• Potential disclosure of sensitive messages across tenants.
• Possible deletion of source topic data by an attacker.
• Verification of Apache Pulsar installations and configurations is necessary to prevent exploitation.
• Implementation of additional security measures to detect and prevent unauthorized access.

Technical summary

The vulnerability exists in Apache Pulsar's shadow topic feature, which allows an authenticated user to bind a topic in one tenant to a persistent topic in any other tenant. This is due to missing authorization checks when creating or updating topics with the PULSAR.SHADOW_SOURCE property. As a result, an attacker could potentially disclose and delete messages across tenants. The existing authorization for shadow topic configuration (the SHADOW_TOPIC topic policy on the source topic) is applied only to the source-side shadow topics admin API, not to these paths. The impact analysis assumes that Pulsar has been configured with the default authorization provider, where these operations require the tenant admin [

Defensive priority

Defenders should prioritize verifying and updating Apache Pulsar installations, especially in multi-tenant environments, to prevent unauthorized cross-tenant data access and manipulation.

Recommended defensive actions

• Verify and update Apache Pulsar installations to the latest version, especially in multi-tenant environments.
• Restrict access to sensitive data and systems to prevent unauthorized access.
• Monitor for suspicious activity and implement additional security measures to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. However, specific details about exploitation or victim impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.