CVE-2026-105942 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Pulsar instances should assess exposure and prioritize patching due to potential privilege escalation risks. This includes Apache Pulsar administrators and instances with proxy roles configured. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Planning vendor-supported updates or mitigations through normal change control where exposure is

Why it matters

Defenders should care about CVE-2026-105942 because it allows privilege escalation in Apache Pulsar, potentially leading to unauthorized access. Roles and deployment contexts at risk include Apache Pulsar administrators and instances with proxy roles configured. Supported consequences include increased risk of unauthorized access and potential privilege escalation. Evidence limits include lack of information on exploitation or affected versions.

• Potential privilege escalation for attackers
• Increased risk for unauthorized access
• Need for verification of affected versions and configurations
• Priority for applying patches or updates

Technical summary

The vulnerability occurs when a configured proxy role sends a request to the broker on behalf of another user. The broker authorizes both the proxy role and the original principal, but due to flaws, the original principal is authorized with the proxy's authentication data instead of its own. This affects the admin REST API of the broker, functions worker, and Pulsar binary protocol under certain conditions.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to potential privilege escalation risks in Apache Pulsar.

Recommended defensive actions

• Verify Apache Pulsar versions and configurations for potential exposure
• Apply patches or updates from the vendor
• Review and adjust authorization settings for proxy roles
• Monitor for suspicious activity or requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or affected versions. The flaw affects authorization providers that resolve permissions from the role name only, such as the default authorization provider. However, the multi-role token authorization provider (MultiRolesTokenAuthorizationProvider) added in Apache Pulsar 2.8.1 is not affected as it resolves roles from the role claim of the token in the authentication data. Defenders should verify affected versions,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.