CVE-2026-105944 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for administering Apache Pulsar clusters and ensuring the security of the Pulsar Manager console should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, restrict access, and monitor for suspicious activity.

Why it matters

Apache Pulsar Manager security issues require immediate attention from defenders to prevent unauthorized access and potential exploitation. The issues include missing authentication and authorization, and disclosure of the Pulsar admin credential, affecting versions 0.3.0 and later.

• Verify exposure to unauthorized Pulsar admin API access
• Restrict access to Pulsar Manager to prevent unauthorized account creation
• Monitor for suspicious activity and review configurations to prevent exploitation
• Update to a fixed version of Apache Pulsar Manager to prevent continued exposure

Technical summary

Apache Pulsar Manager has critical security issues including missing authentication and authorization, and disclosure of the Pulsar admin credential. An unauthenticated user can create an administrator account and use Pulsar Manager to send requests to the Pulsar admin API with the configured credential. These issues affect versions 0.3.0 and later, and 0.2.0 for some requests. Defenders should prioritize verifying exposure, restricting access, and monitoring for suspicious activity. Remediation involves updating to a fixed version and reviewing configurations.

Defensive priority

Defenders should prioritize verifying exposure, restricting access, and monitoring for suspicious activity. Remediation involves updating to a fixed version and reviewing configurations.

Recommended defensive actions

• Verify exposure by checking if Apache Pulsar Manager is in use and if the version is affected
• Restrict access to Pulsar Manager and configure authentication
• Monitor for suspicious activity and review configurations
• Update to a fixed version of Apache Pulsar Manager
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the security issues in Apache Pulsar Manager. The issues include missing authentication and authorization, and disclosure of the Pulsar admin credential.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.