CVE-2026-105938 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar deployments, especially those using subscription authorization policies, should assess exposure and prioritize patching to prevent potential unauthorized actions on subscriptions.

Why it matters

The vulnerability in Apache Pulsar could allow an authenticated user to perform unauthorized actions on subscriptions, potentially impacting data integrity and availability. Defenders should prioritize verifying and applying patches, assessing exposure based on deployment contexts, and monitoring for potential unauthorized actions.

• Potential data integrity impact due to unauthorized backlog clearing.
• Potential availability impact due to unauthorized subscription unsubscription.
• Potential data loss due to unauthorized message expiration.
• Verification priority for affected Apache Pulsar versions and configurations.

Technical summary

The vulnerability in Apache Pulsar involves subscription authorization policies not being enforced by certain namespace-level backlog and unsubscribe operations, as well as by the topic expire-all operation. This could allow an authenticated user with consume permission to perform actions that should be restricted by subscription policies, potentially impacting data integrity and availability. The issue affects Apache Pulsar deployments using subscription authorization policies, particularly those with Prefix subscription authentication mode or specific subscription permissions.

Defensive priority

Defenders should prioritize verifying and applying patches for Apache Pulsar, especially for versions 2.8.0 to 4.0.14 and 4.1.0 to 4.2.5, and assess exposure based on their deployment contexts.

Recommended defensive actions

• Verify and apply patches for Apache Pulsar versions 2.8.0 to 4.0.14 and 4.1.0 to 4.2.5.
• Assess exposure based on deployment contexts and subscription authorization policies.
• Monitor for and respond to potential unauthorized actions on subscriptions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in Apache Pulsar, including affected versions (Apache Pulsar 2.8.0 to 4.0.14 and 4.1.0 to 4.2.5) and operations that do not enforce subscription authorization policies. The default authorization provider allows namespace-level operations with only consume permission granted on the namespace, and the expire-all operation requires only consume permission on the topic. Defenders should verify and apply patches, assess exposure based on deployment contexts, and monitor [

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.